DISA_STIG_Solaris_11_SPARC_v3r1.audit from DISA Solaris 11 SPARC v3r1 STIG

SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.

800-53|AU-3

CAT|II

CCI|CCI-001487

CCI|CCI-004188

Rule-ID|SV-216246r986419_rule

STIG-ID|SOL-11.1-010040

STIG-Legacy|SV-60657

STIG-Legacy|V-47781

Vuln-ID|V-216246

SOL-11.1-010060 - The audit system must support an audit reduction capability.

800-53|AU-7a.

CCI|CCI-001877

Rule-ID|SV-219959r958768_rule

STIG-ID|SOL-11.1-010060

STIG-Legacy|SV-60659

STIG-Legacy|V-47783

Vuln-ID|V-219959

SOL-11.1-010070 - The audit system records must be able to be used by a report generation capability.

CCI|CCI-001880

Rule-ID|SV-219960r958774_rule

STIG-ID|SOL-11.1-010070

STIG-Legacy|SV-60661

STIG-Legacy|V-47785

Vuln-ID|V-219960

SOL-11.1-010080 - The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

800-53|AU-7(1)

CCI|CCI-000158

Rule-ID|SV-216249r958430_rule

STIG-ID|SOL-11.1-010080

STIG-Legacy|SV-60663

STIG-Legacy|V-47787

Vuln-ID|V-216249

SOL-11.1-010100 - The audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-219961r958442_rule

STIG-ID|SOL-11.1-010100

STIG-Legacy|SV-60665

STIG-Legacy|V-47789

Vuln-ID|V-219961

SOL-11.1-010120 - The operating system must generate audit records for the selected list of auditable events as defined in DoD list of events.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-216251r958446_rule

STIG-ID|SOL-11.1-010120

STIG-Legacy|SV-60667

STIG-Legacy|V-47791

Vuln-ID|V-216251

SOL-11.1-010130 - The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.

Rule-ID|SV-219962r958442_rule

STIG-ID|SOL-11.1-010130

STIG-Legacy|SV-60669

STIG-Legacy|V-47793

Vuln-ID|V-219962

SOL-11.1-010140 - Audit records must include what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-216253r958412_rule

STIG-ID|SOL-11.1-010140

STIG-Legacy|SV-60671

STIG-Legacy|V-47795

Vuln-ID|V-216253

SOL-11.1-010150 - Audit records must include when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-216254r958414_rule

STIG-ID|SOL-11.1-010150

STIG-Legacy|SV-60673

STIG-Legacy|V-47797

Vuln-ID|V-216254

SOL-11.1-010160 - Audit records must include where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216255r958416_rule

STIG-ID|SOL-11.1-010160

STIG-Legacy|SV-60675

STIG-Legacy|V-47799

Vuln-ID|V-216255

SOL-11.1-010170 - Audit records must include the sources of the events that occurred.

CCI|CCI-000133

Rule-ID|SV-216256r958418_rule

STIG-ID|SOL-11.1-010170

STIG-Legacy|SV-60677

STIG-Legacy|V-47801

Vuln-ID|V-216256

SOL-11.1-010180 - Audit records must include the outcome (success or failure) of the events that occurred.

CCI|CCI-000134

Rule-ID|SV-216257r958420_rule

STIG-ID|SOL-11.1-010180

STIG-Legacy|SV-60679

STIG-Legacy|V-47803

Vuln-ID|V-216257

SOL-11.1-010220 - The audit system must be configured to audit file deletions.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-216258r959010_rule

STIG-ID|SOL-11.1-010220

STIG-Legacy|SV-60681

STIG-Legacy|V-47805

Vuln-ID|V-216258

SOL-11.1-010230 - The audit system must be configured to audit account creation.

800-53|AC-2(4)

CCI|CCI-000018

Rule-ID|SV-216259r958368_rule

STIG-ID|SOL-11.1-010230

STIG-Legacy|SV-60683

STIG-Legacy|V-47807

Vuln-ID|V-216259

SOL-11.1-010250 - The audit system must be configured to audit account modification.

CCI|CCI-001403

Rule-ID|SV-216260r958590_rule

STIG-ID|SOL-11.1-010250

STIG-Legacy|SV-60685

STIG-Legacy|V-47809

Vuln-ID|V-216260

SOL-11.1-010260 - The operating system must automatically audit account disabling actions.

CCI|CCI-001404

Rule-ID|SV-216261r958592_rule

STIG-ID|SOL-11.1-010260

STIG-Legacy|SV-60687

STIG-Legacy|V-47811

Vuln-ID|V-216261

SOL-11.1-010270 - The operating system must automatically audit account termination.

CCI|CCI-001405

Rule-ID|SV-216262r958594_rule

STIG-ID|SOL-11.1-010270

STIG-Legacy|SV-60689

STIG-Legacy|V-47813

Vuln-ID|V-216262

SOL-11.1-010290 - The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked.

Rule-ID|SV-216263r959010_rule

STIG-ID|SOL-11.1-010290

STIG-Legacy|SV-60691

STIG-Legacy|V-47815

Vuln-ID|V-216263

SOL-11.1-010300 - The audit system must be configured to audit all administrative, privileged, and security actions.

Rule-ID|SV-216264r959010_rule

STIG-ID|SOL-11.1-010300

STIG-Legacy|SV-60693

STIG-Legacy|V-47817

Vuln-ID|V-216264

SOL-11.1-010310 - The audit system must be configured to audit login, logout, and session initiation.

800-53|AC-17(1)

CAT|III

CCI|CCI-000067

Rule-ID|SV-216265r958406_rule

STIG-ID|SOL-11.1-010310

STIG-Legacy|SV-60695

STIG-Legacy|V-47819

Vuln-ID|V-216265

SOL-11.1-010320 - The audit system must be configured to audit all discretionary access control permission modifications.

Rule-ID|SV-219963r958442_rule

STIG-ID|SOL-11.1-010320

STIG-Legacy|SV-60697

STIG-Legacy|V-47821

Vuln-ID|V-219963

SOL-11.1-010330 - The audit system must be configured to audit the loading and unloading of dynamic kernel modules.

Rule-ID|SV-219964r958442_rule

STIG-ID|SOL-11.1-010330

STIG-Legacy|SV-60699

STIG-Legacy|V-47823

Vuln-ID|V-219964

SOL-11.1-010340 - The audit system must be configured to audit failed attempts to access files and programs.

Rule-ID|SV-216268r959010_rule

STIG-ID|SOL-11.1-010340

STIG-Legacy|SV-60701

STIG-Legacy|V-47825

Vuln-ID|V-216268

SOL-11.1-010350 - The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server.

800-53|AU-10

CCI|CCI-000166

Rule-ID|SV-216269r958440_rule

STIG-ID|SOL-11.1-010350

STIG-Legacy|SV-60703

STIG-Legacy|V-47827

Vuln-ID|V-216269

SOL-11.1-010360 - The auditing system must not define a different auditing level for specific users.

Rule-ID|SV-216270r959010_rule

STIG-ID|SOL-11.1-010360

STIG-Legacy|SV-60705

STIG-Legacy|V-47831

Vuln-ID|V-216270

SOL-11.1-010370 - The audit system must alert the SA when the audit storage volume approaches its capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-219965r971542_rule

STIG-ID|SOL-11.1-010370

STIG-Legacy|SV-60709

STIG-Legacy|V-47835

Vuln-ID|V-219965

SOL-11.1-010380 - The audit system must alert the System Administrator (SA) if there is any type of audit failure.

800-53|AU-5(2)

CAT|I

CCI|CCI-001858

Rule-ID|SV-219966r958758_rule

STIG-ID|SOL-11.1-010380

STIG-Legacy|SV-60717

STIG-Legacy|V-47843

Vuln-ID|V-219966

SOL-11.1-010390 - The operating system must alert designated organizational officials in the event of an audit processing failure.

800-53|AU-5a.

CCI|CCI-000139

Detections

Analytics

Revision 1.1

Oct 15, 2024

Functional Update