Detections
Analytics

Item Search

NameAudit NamePluginCategory
2.1 Ensure that IP addresses are mapped to usernames - User ID AgentsCIS Palo Alto Firewall 10 v1.1.0 L2Palo_Alto
2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 11 Enterprise v1.0.0 L1 + BL + NGWindows
2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + NGWindows
2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BL + NGWindows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 11 Enterprise v1.0.0 L1 + BLWindows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 11 Enterprise v1.0.0 L1Windows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + NGWindows
4.1.3.11 Ensure session initiation information is collectedCIS Oracle Linux 9 Server L2 v1.0.0Unix
4.1.3.11 Ensure session initiation information is collected - auditctl btmpCIS Oracle Linux 8 Workstation L2 v2.0.0Unix
4.1.3.11 Ensure session initiation information is collected - auditctl btmpCIS Red Hat EL8 Workstation L2 v2.0.0Unix
4.1.3.11 Ensure session initiation information is collected - auditctl utmpCIS Red Hat EL8 Server L2 v2.0.0Unix
4.1.3.11 Ensure session initiation information is collected - auditctl wtmpCIS Red Hat EL8 Server L2 v2.0.0Unix
4.1.3.11 Ensure session initiation information is collected - auditctl wtmpCIS Ubuntu Linux 22.04 LTS Server L2 v.1.0.0Unix
4.1.3.11 Ensure session initiation information is collected - btmpCIS Oracle Linux 8 Workstation L2 v2.0.0Unix
4.1.3.11 Ensure session initiation information is collected - wtmpCIS Ubuntu Linux 22.04 LTS Workstation L2 v.1.0.0Unix
4.1.3.12 Ensure login and logout events are collected - faillockCIS AlmaLinux OS 8 Server L2 v2.0.0Unix
4.1.4 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS Red Hat EL8 Workstation L2 v1.0.1Unix
4.1.4 Ensure login and logout events are collected - auditctl faillockCIS Oracle Linux 8 Workstation L2 v1.0.1Unix
4.1.5 Ensure session initiation information is collected - auditctl utmpCIS Red Hat EL8 Server L2 v1.0.1Unix
4.1.5 Ensure session initiation information is collected - auditctl utmpCIS Red Hat EL8 Workstation L2 v1.0.1Unix
4.1.5 Ensure session initiation information is collected - utmpCIS Red Hat EL8 Workstation L2 v1.0.1Unix
4.1.5 Ensure session initiation information is collected - wtmpCIS Oracle Linux 8 Workstation L2 v1.0.1Unix
4.1.5 Ensure session initiation information is collected - wtmpCIS Red Hat EL8 Workstation L2 v1.0.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/lastlogCIS CentOS 7 v3.1.1 Server L2Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillockCIS CentOS 7 v3.1.2 Server L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillogCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/run/faillockCIS CentOS 7 v3.1.2 Server L2Unix
4.1.7 Ensure login and logout events are collected - auditctl tallylogCIS Debian 10 Server L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl tallylogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - lastlogCIS Debian 10 Server L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - lastlogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/btmpCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/wtmpCIS Debian 10 Server L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl /var/log/wtmpCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl btmpCIS CentOS 7 v3.1.1 Server L2Unix
4.1.8 Ensure session initiation information is collected - auditctl btmpCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.8 Ensure session initiation information is collected - auditctl wtmpCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.8 Ensure session initiation information is collected - btmpCIS CentOS 7 v3.1.1 Server L2Unix
5.2.7 Ensure SSH MaxAuthTries is set to 4 or less - sshd_configCIS Red Hat EL8 Workstation L1 v1.0.1Unix
17.5.3 (L1) Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows Server 2019 v3.0.0 L1 Domain ControllerWindows
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 11 Enterprise v1.0.0 L1Windows
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1Windows
17.5.4 (L1) Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows Server 2019 v3.0.0 L1 Domain ControllerWindows
17.5.4 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1Windows
17.5.5 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows Server 2019 STIG DC STIG v1.0.1Windows
17.5.5 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows Server 2019 STIG MS STIG v1.0.1Windows
17.5.5 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + NGWindows
17.5.6 (L1) Ensure 'Audit Special Logon' is set to include 'Success'CIS Microsoft Windows Server 2019 v3.0.0 L1 Member ServerWindows
17.5.6 Ensure 'Audit Special Logon' is set to include 'Success'CIS Microsoft Windows 11 Enterprise v1.0.0 L1Windows