Revision 1.11

Sep 19, 2023

Functional Update

4.1.3.10 Ensure successful file system mounts are collected - 32-bit
4.1.3.10 Ensure successful file system mounts are collected - 64-bit
4.1.3.11 Ensure session initiation information is collected - auditctl btmp
4.1.3.11 Ensure session initiation information is collected - auditctl wtmp
4.1.3.11 Ensure session initiation information is collected - btmp
4.1.3.11 Ensure session initiation information is collected - wtmp
4.1.3.13 Ensure file deletion events by users are collected - 32-bit
4.1.3.13 Ensure file deletion events by users are collected - 64-bit
4.1.3.13 Ensure file deletion events by users are collected - auditctl (32-bit)
4.1.3.13 Ensure file deletion events by users are collected - auditctl (64-bit)
4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl network
4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
4.1.4.3 Ensure only authorized groups are assigned ownership of audit log files

Added

4.1.3.12 Ensure login and logout events are collected - /var/run/faillock
4.1.3.12 Ensure login and logout events are collected - auditctl /var/run/faillock
4.1.3.19 Ensure kernel module loading unloading and modification is collected - /usr/bin/kmod (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl /usr/bin/kmod (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modules (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks
4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - modules (64-bit)
4.1.3.4 Ensure events that modify date and time information are collected - (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - (64-bit)
4.1.3.4 Ensure events that modify date and time information are collected - audiitctl (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - auditctl (64-bit)
4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network/
4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/networks
4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl /etc/networks
4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b32
4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b64
4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b32
4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b64
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b32
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b64
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b32
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b64
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/fchownat/lchown
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr/removexattr
4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/fchownat/lchown
4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
4.1.4.3 Ensure only authorized groups are assigned ownership of audit log files - auditd.conf log_group

Removed

4.1.3.12 Ensure login and logout events are collected - /var/log/faillog
4.1.3.12 Ensure login and logout events are collected - /var/log/tallylog
4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/faillog
4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/tallylog
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (32-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl insmod
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modprobe
4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl rmmod
4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (64-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (32-bit)
4.1.3.19 Ensure kernel module loading unloading and modification is collected - insmod
4.1.3.19 Ensure kernel module loading unloading and modification is collected - modprobe
4.1.3.19 Ensure kernel module loading unloading and modification is collected - rmmod
4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (64-bit)
4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)
4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)
4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (32-bit)
4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (64-bit)
4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network
4.1.3.6 Ensure use of privileged commands are collected
4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES
4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES (64-bit)
4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM
4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM (64-bit)
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES (64-bit)
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM
4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)
4.1.3.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)