| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events | DISA STIG AIX 7.x v2r8 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/group | DISA STIG AIX 7.x v2r6 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/group | DISA STIG AIX 7.x v2r5 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/audit/config | DISA STIG AIX 7.x v2r5 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/environ | DISA STIG AIX 7.x v2r6 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/group | DISA STIG AIX 7.x v2r6 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/limits | DISA STIG AIX 7.x v2r6 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/login.cfg | DISA STIG AIX 7.x v2r5 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/passwd read | DISA STIG AIX 7.x v2r5 | Unix | |
| AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/passwd write | DISA STIG AIX 7.x v2r6 | Unix | |
| Big Sur - Configure the System to Notify upon Account Removed Actions | NIST macOS Big Sur v1.4.0 - 800-53r4 Moderate | Unix | ACCESS CONTROL |
| Big Sur - Configure the System to Notify upon Account Removed Actions | NIST macOS Big Sur v1.4.0 - All Profiles | Unix | ACCESS CONTROL |
| Big Sur - Configure the System to Notify upon Account Removed Actions | NIST macOS Big Sur v1.4.0 - CNSSI 1253 | Unix | ACCESS CONTROL |
| Big Sur - Configure the System to Notify upon Account Removed Actions | NIST macOS Big Sur v1.4.0 - 800-53r4 High | Unix | ACCESS CONTROL |
| Catalina - Configure the System to Notify upon Account Removed Actions | NIST macOS Catalina v1.5.0 - 800-53r4 High | Unix | ACCESS CONTROL |
| Catalina - Configure the System to Notify upon Account Removed Actions | NIST macOS Catalina v1.5.0 - All Profiles | Unix | ACCESS CONTROL |
| Catalina - Configure the System to Notify upon Account Removed Actions | NIST macOS Catalina v1.5.0 - 800-53r4 Moderate | Unix | ACCESS CONTROL |
| Catalina - Configure the System to Notify upon Account Removed Actions | NIST macOS Catalina v1.5.0 - CNSSI 1253 | Unix | ACCESS CONTROL |
| F5BI-DM-000161 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are removed. | DISA F5 BIG-IP Device Management 11.x STIG v1r7 | F5 | |
| F5BI-DM-000161 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are removed. | DISA F5 BIG-IP Device Management 11.x STIG v2r2 | F5 | |
| F5BI-DM-000161 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are removed. | DISA F5 BIG-IP Device Management 11.x STIG v2r1 | F5 | |
| F5BI-DM-000161 - The BIG-IP appliance must be configured to generate alerts that can be forwarded to the administrators and Information System Security Officer (ISSO) when accounts are removed. | DISA F5 BIG-IP Device Management STIG v2r3 | F5 | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| JUSX-DM-000061 - In the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally. | DISA Juniper SRX Services Gateway NDM v2r1 | Juniper | |
| Monterey - Configure the System to Notify upon Account Removed Actions | NIST macOS Monterey v1.0.0 - 800-53r4 High | Unix | ACCESS CONTROL |
| Monterey - Configure the System to Notify upon Account Removed Actions | NIST macOS Monterey v1.0.0 - 800-53r4 Moderate | Unix | ACCESS CONTROL |
| Monterey - Configure the System to Notify upon Account Removed Actions | NIST macOS Monterey v1.0.0 - All Profiles | Unix | ACCESS CONTROL |
| Monterey - Configure the System to Notify upon Account Removed Actions | NIST macOS Monterey v1.0.0 - CNSSI 1253 | Unix | ACCESS CONTROL |
| PHTN-67-000040 - The Photon operating system must configure rsyslog to offload system logs to a central server. | DISA STIG VMware vSphere 6.7 Photon OS v1r1 | Unix | |
| PHTN-67-000040 - The Photon operating system must configure rsyslog to offload system logs to a central server. | DISA STIG VMware vSphere 6.7 Photon OS v1r3 | Unix | |
| PHTN-67-000040 - The Photon operating system must configure rsyslog to offload system logs to a central server. | DISA STIG VMware vSphere 6.7 Photon OS v1r5 | Unix | |
| PHTN-67-000040 - The Photon operating system must configure rsyslog to offload system logs to a central server. | DISA STIG VMware vSphere 6.7 Photon OS v1r6 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| RHEL-09-654240 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA Red Hat Enterprise Linux 9 STIG v1r3 | Unix | |
| RHEL-09-654240 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA Red Hat Enterprise Linux 9 STIG v1r1 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r6 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r11 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r12 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r10 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r9 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r13 | Unix | |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r1 | Unix | AUDIT AND ACCOUNTABILITY |
| SLES-15-030000 - The SUSE operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd. | DISA SLES 15 STIG v1r3 | Unix | AUDIT AND ACCOUNTABILITY |
| SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling). | DISA STIG Splunk Enterprise 8.x for Linux v1r3 STIG REST API | Splunk | |
| SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling). | DISA STIG Splunk Enterprise 8.x for Linux v1r4 STIG REST API | Splunk | |
| SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling). | DISA STIG Splunk Enterprise 8.x for Linux v1r5 STIG REST API | Splunk | |
| SPLK-CL-000200 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, disabling). | DISA STIG Splunk Enterprise 7.x for Windows v2r3 REST API | Splunk | |
| SPLK-CL-000200 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, disabling). | DISA STIG Splunk Enterprise 7.x for Windows v2r4 REST API | Splunk | |
| SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only. | DISA STIG Splunk Enterprise 7.x for Windows v2r3 REST API | Splunk | |
| SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only. | DISA STIG Splunk Enterprise 7.x for Windows v2r4 REST API | Splunk | |
| VCSA-70-000123 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action. | DISA STIG VMware vSphere 7.0 vCenter v1r2 | VMware | |
| VCSA-70-000123 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action. | DISA STIG VMware vSphere 7.0 vCenter v1r3 | VMware | ACCESS CONTROL |
