CIS Amazon Linux 2 v1.0.0 L2

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: CIS Amazon Linux 2 v1.0.0 L2

Updated: 2/8/2022

Authority: CIS

Plugin: Unix

Revision: 1.8

Estimated Item Count: 133

Audit Changelog


Revision 1.8 Feb 8, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.7 Jun 17, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.6 Oct 5, 2020 Functional Update 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl b64 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/lchown/fchownat 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr 4.1.10 Ensure discretionary access control permission modification events are collected - b64 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/lchown/fchownat 4.1.10 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl 64 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl b64 EACCES 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl b64 EPERM 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EPERM 4.1.13 Ensure successful file system mounts are collected - auditctl b64 4.1.13 Ensure successful file system mounts are collected - auditctl b64 mounts 4.1.13 Ensure successful file system mounts are collected - b64 4.1.13 Ensure successful file system mounts are collected - b64 mounts 4.1.14 Ensure file deletion events by users are collected - auditctl b64 4.1.14 Ensure file deletion events by users are collected - b64 4.1.17 Ensure kernel module loading and unloading is collected - auditctl b64 init_module 4.1.17 Ensure kernel module loading and unloading is collected - b64 init_module 4.1.4 Ensure events that modify date and time information are collected - /etc/localtime b64 4.1.4 Ensure events that modify date and time information are collected - adjtimex b32 4.1.4 Ensure events that modify date and time information are collected - adjtimex b64 4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex b64 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime b64 4.1.4 Ensure events that modify date and time information are collected - b64 adjtimex 4.1.4 Ensure events that modify date and time information are collected - clock_settime b32 4.1.4 Ensure events that modify date and time information are collected - clock_settime b64 4.1.4 Ensure events that modify date and time information are collected - localtime b64 4.1.4 Ensure events that modify date and time information are collected - stime b32 4.1.6 Ensure events that modify the system's network environment are collected - 64b sethostname 4.1.6 Ensure events that modify the system's network environment are collected - auditctl 64b sethostname 4.1.6 Ensure events that modify the system's network environment are collected - auditctl b64 sethostname 4.1.6 Ensure events that modify the system's network environment are collected - b64 sethostname Miscellaneous Platform check updated.
Revision 1.5 Sep 29, 2020 Miscellaneous References updated.
Revision 1.4 Sep 3, 2020 Functional Update 4.1.10 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/lchown/fchownat 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat 4.1.10 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/lchown/fchownat 4.1.10 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr 4.1.10 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat 4.1.10 Ensure discretionary access control permission modification events are collected - chown/fchown/lchown/fchownat 4.1.10 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES 4.1.11 Ensure unsuccessful unauthorized file access attempts are collected - b64 EPERM 4.1.13 Ensure successful file system mounts are collected - b64 mounts 4.1.13 Ensure successful file system mounts are collected - mounts 4.1.14 Ensure file deletion events by users are collected 4.1.14 Ensure file deletion events by users are collected - b64 4.1.15 Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers 4.1.15 Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers.d 4.1.16 Ensure system administrator actions (sudolog) are collected 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/insmod 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/modprobe 4.1.17 Ensure kernel module loading and unloading is collected - /sbin/rmmod 4.1.17 Ensure kernel module loading and unloading is collected - auditctl b64 init_module 4.1.17 Ensure kernel module loading and unloading is collected - b64 init_module 4.1.17 Ensure kernel module loading and unloading is collected - init_module 4.1.18 Ensure the audit configuration is immutable 4.1.3 Ensure auditing for processes that start prior to auditd is enabled 4.1.4 Ensure events that modify date and time information are collected - adjtimex 4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex 4.1.4 Ensure events that modify date and time information are collected - auditctl adjtimex b64 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime 4.1.4 Ensure events that modify date and time information are collected - auditctl clock_settime b64 4.1.4 Ensure events that modify date and time information are collected - auditctl localtime 4.1.4 Ensure events that modify date and time information are collected - clock_settime 4.1.4 Ensure events that modify date and time information are collected - localtime 4.1.4 Ensure events that modify date and time information are collected - stime b32 4.1.5 Ensure events that modify user/group information are collected - /etc/group 4.1.5 Ensure events that modify user/group information are collected - /etc/gshadow 4.1.5 Ensure events that modify user/group information are collected - /etc/passwd 4.1.5 Ensure events that modify user/group information are collected - /etc/security/opasswd 4.1.5 Ensure events that modify user/group information are collected - /etc/shadow 4.1.6 Ensure events that modify the system's network environment are collected - /etc/hosts 4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue 4.1.6 Ensure events that modify the system's network environment are collected - /etc/issue.net 4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network 4.1.6 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network-scripts 4.1.6 Ensure events that modify the system's network environment are collected - auditctl b64 sethostname 4.1.6 Ensure events that modify the system's network environment are collected - auditctl sethostname 4.1.6 Ensure events that modify the system's network environment are collected - b64 sethostname 4.1.6 Ensure events that modify the system's network environment are collected - sethostname 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - /usr/share/selinux 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/selinux 4.1.7 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /usr/share/selinux 4.1.8 Ensure login and logout events are collected - /var/log/lastlog 4.1.8 Ensure login and logout events are collected - /var/run/faillock 4.1.8 Ensure login and logout events are collected - auditctl /var/log/lastlog 4.1.8 Ensure login and logout events are collected - auditctl /var/run/faillock 4.1.9 Ensure session initiation information is collected - /var/log/btmp 4.1.9 Ensure session initiation information is collected - /var/log/wtmp 4.1.9 Ensure session initiation information is collected - /var/run/utmp Informational Update 4.1.8 Ensure login and logout events are collected - /var/log/lastlog 4.1.8 Ensure login and logout events are collected - /var/run/faillock 4.1.8 Ensure login and logout events are collected - auditctl /var/log/lastlog 4.1.8 Ensure login and logout events are collected - auditctl /var/run/faillock
Revision 1.3 Jul 14, 2020 Miscellaneous Metadata updated.
Revision 1.2 Apr 17, 2020 Miscellaneous Metadata updated. References updated.
Revision 1.1 Aug 5, 2019 Miscellaneous Metadata updated. See also link updated.