Capacity
AU-12(c)
29
Rule
Severity: Medium
Enable auditd Service
30
Rule
Severity: Medium
Record Events that Modify the System's Mandatory Access Controls
30
Rule
Severity: Medium
Record Events that Modify the System's Mandatory Access Controls in usr/share
29
Rule
Severity: Medium
Ensure auditd Collects Information on Exporting to Media (successful)
30
Rule
Severity: Medium
Record Events that Modify the System's Network Environment
30
Rule
Severity: Medium
Record Attempts to Alter Process and Session Initiation Information
28
Rule
Severity: Medium
Ensure auditd Collects System Administrator Actions
29
Rule
Severity: Medium
Record Events that Modify User/Group Information
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chmod
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - chown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmod
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchmodat
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fchownat
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fremovexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - fsetxattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lchown
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lremovexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - lsetxattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - removexattr
29
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - setxattr
23
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rename
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - renameat
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - rmdir
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlink
29
Rule
Severity: Medium
Ensure auditd Collects File Deletion Events by User - unlinkat
23
Rule
Severity: Medium
Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - creat
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - ftruncate
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open
24
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - open_by_handle_at
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - openat
23
Rule
Severity: Medium
Record Unsuccessful Access Attempts to Files - truncate
23
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading and Unloading
21
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Unloading - delete_module
22
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
21
Rule
Severity: Medium
Ensure auditd Collects Information on Kernel Module Loading - init_module
29
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - init
29
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - poweroff
29
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - reboot
29
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - shutdown
29
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands
30
Rule
Severity: Medium
Record attempts to alter time through adjtimex
30
Rule
Severity: Medium
Record Attempts to Alter Time Through clock_settime
30
Rule
Severity: Medium
Record attempts to alter time through settimeofday
29
Rule
Severity: Medium
Record Attempts to Alter Time Through stime
29
Rule
Severity: Medium
Record Attempts to Alter the localtime File
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open syscall - /etc/group
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via openat syscall - /etc/group
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open syscall - /etc/gshadow
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via openat syscall - /etc/gshadow
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open syscall - /etc/passwd
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via openat syscall - /etc/passwd
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open syscall - /etc/shadow
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow
11
Rule
Severity: Medium
Record Events that Modify User/Group Information via openat syscall - /etc/shadow
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/group
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/gshadow
19
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/security/opasswd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/passwd
20
Rule
Severity: Medium
Record Events that Modify User/Group Information - /etc/shadow
12
Rule
Severity: Medium
Record Access Events to Audit Log Directory
16
Rule
Severity: Medium
Record Any Attempts to Run chcon
14
Rule
Severity: Medium
Record Any Attempts to Run restorecon
14
Rule
Severity: Medium
Record Any Attempts to Run semanage
13
Rule
Severity: Medium
Record Any Attempts to Run setfiles
14
Rule
Severity: Medium
Record Any Attempts to Run setsebool
12
Rule
Severity: Medium
Record Any Attempts to Run seunshare
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - chmod
11
Rule
Severity: Medium
Record Unsuccessful Ownership Changes to Files - chown
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - fchmod
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - fchmodat
11
Rule
Severity: Medium
Record Unsuccessful Ownership Changes to Files - fchown
11
Rule
Severity: Medium
Record Unsuccessful Ownership Changes to Files - fchownat
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - fremovexattr
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - fsetxattr
11
Rule
Severity: Medium
Record Unsuccessful Ownership Changes to Files - lchown
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - lremovexattr
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - lsetxattr
11
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
11
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
11
Rule
Severity: Medium
Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly
11
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - open O_CREAT
11
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
11
Rule
Severity: Medium
Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly
11
Rule
Severity: Medium
Record Unsuccessful Creation Attempts to Files - openat O_CREAT
11
Rule
Severity: Medium
Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
11
Rule
Severity: Medium
Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - removexattr
14
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - rename
14
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - renameat
11
Rule
Severity: Medium
Record Unsuccessful Permission Changes to Files - setxattr
14
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - unlink
14
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - unlinkat
18
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events
20
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - faillock
23
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - lastlog
21
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - tallylog
14
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - at
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chage
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chsh
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - crontab
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
9
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - insmod
9
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - mount
13
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
13
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - passwd
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - postdrop
16
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
11
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - su
18
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - sudo
15
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - umount
17
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
14
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - userhelper
12
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl
5
Rule
Severity: Unknown
Configure Logging
1
Rule
Severity: Medium
Record Access Events to Kubernetes Audit Log Directory
1
Rule
Severity: Medium
Record Access Events to OAuth Audit Log Directory
1
Rule
Severity: Medium
Record Access Events to OpenShift Audit Log Directory
1
Rule
Severity: Medium
Ensure the libaudit1 package as a part of audit Subsystem is Installed
1
Rule
Severity: Medium
Ensure the audit Subsystem is Installed
1
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - umount
1
Rule
Severity: Medium
Record Events that Modify the System's Discretionary Access Controls - umount2
1
Rule
Severity: Medium
Record Any Attempts to Run chacl
1
Rule
Severity: Medium
Record Any Attempts to Run chmod
1
Rule
Severity: Medium
Record Any Attempts to Run setfacl
1
Rule
Severity: Medium
Record Any Attempts to Run rm
1
Rule
Severity: Medium
Record Attempts to Alter Logon and Logout Events - faillog
4
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - chfn
1
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - passmass
1
Rule
Severity: Medium
Record Any Attempts to Run ssh-agent
1
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - usermod
3
Rule
Severity: Medium
Record Attempts to Alter Process and Session Initiation Information btmp
3
Rule
Severity: Medium
Record Attempts to Alter Process and Session Initiation Information utmp
3
Rule
Severity: Medium
Record Attempts to Alter Process and Session Initiation Information wtmp
1
Rule
Severity: Medium
Record Unsuccessful Delete Attempts to Files - renameat2
1
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - rmmod
1
Rule
Severity: Medium
Ensure auditd Collects Information on the Use of Privileged Commands - unix2_chkpwd
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules