Detections
Analytics

Item Search

NameAudit NamePluginCategory
2.3.11.3 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows Server 2008 Domain Controller Level 1 v3.2.0Windows
4.1.3.12 Ensure login and logout events are collectedCIS Oracle Linux 9 Workstation L2 v1.0.0Unix
4.1.3.12 Ensure login and logout events are collectedCIS Red Hat EL9 Workstation L2 v1.0.0Unix
4.1.3.12 Ensure login and logout events are collectedCIS Debian Linux 11 Server L2 v.1.0.0Unix
4.1.3.12 Ensure login and logout events are collected - auditctl faillockCIS AlmaLinux OS 8 Workstation L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - auditctl lastlogCIS Oracle Linux 8 Server L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - lastlogCIS Red Hat EL8 Server L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - lastlogCIS Oracle Linux 8 Workstation L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - lastlogCIS AlmaLinux OS 8 Workstation L2 v2.0.0Unix
4.1.7 Ensure login and logout events are collected - /var/log/faillogCIS Red Hat EL7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/lastlogCIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/lastlogCIS Amazon Linux 2 v2.0.0 L2Unix
4.1.7 Ensure login and logout events are collected - /var/log/lastlogCIS CentOS 7 v3.1.2 Server L2Unix
4.1.7 Ensure login and logout events are collected - /var/log/tallylogCIS Oracle Linux 7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/tallylogCIS CentOS 7 v3.1.1 Server L2Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillock/CIS CentOS 7 v3.1.1 Server L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillogCIS Oracle Linux 7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillogCIS CentOS 7 v3.1.2 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS SUSE Linux Enterprise Workstation 12 L2 v3.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS CentOS 7 v3.1.1 Server L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/run/faillock/CIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/run/faillock/CIS CentOS 7 v3.1.2 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl faillogCIS Debian 10 Server L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl lastlogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl tallylogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - lastlogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.7 Ensure login and logout events are collected - tallylogCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/btmpCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/wtmpCIS Debian 10 Server L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/wtmpCIS SUSE Linux Enterprise Server 12 L2 v3.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/log/wtmpCIS SUSE Linux Enterprise Workstation 12 L2 v3.0.0Unix
4.1.8 Ensure session initiation information is collected - /var/run/utmpCIS Debian 10 Server L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl /var/log/wtmpCIS Debian 10 Workstation L2 v1.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl /var/run/utmpCIS SUSE Linux Enterprise Workstation 12 L2 v3.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl utmpCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - auditctl utmpCIS CentOS 7 v3.1.1 Server L2Unix
4.1.8 Ensure session initiation information is collected - btmpCIS CentOS 7 v3.1.2 Server L2Unix
4.1.8 Ensure session initiation information is collected - utmpCIS Red Hat EL7 Server L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - utmpCIS CentOS 7 v3.1.1 Server L2Unix
4.1.8 Ensure session initiation information is collected - utmpCIS CentOS 7 v3.1.2 Server L2Unix
4.1.8 Ensure session initiation information is collected - utmpCIS CentOS 7 v3.1.2 Workstation L2Unix
5.2.7 Ensure SSH MaxAuthTries is set to 4 or lessCIS Red Hat EL7 Server L1 v3.0.1Unix

ACCESS CONTROL

5.2.7 Ensure SSH MaxAuthTries is set to 4 or lessCIS Red Hat EL7 Workstation L1 v3.0.1Unix

ACCESS CONTROL

5.2.7 Ensure SSH MaxAuthTries is set to 4 or lessCIS CentOS Linux 8 Workstation L1 v1.0.0Unix

ACCESS CONTROL

5.2.7 Ensure SSH MaxAuthTries is set to 4 or lessCIS CentOS Linux 8 Server L1 v1.0.0Unix

ACCESS CONTROL

17.5.4 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows Server 2016 STIG NG MS L3 v1.0.0Windows
17.5.5 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows Server 2016 STIG DC L1 v1.0.0Windows
17.5.5 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'CIS Microsoft Windows 11 Enterprise v1.0.0 L1 + BL + NGWindows