Detections
Analytics

Item Search

NameAudit NamePluginCategory
2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BLWindows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + NGWindows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BLWindows
2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BL + NGWindows
4.1.3.12 Ensure login and logout events are collectedCIS Rocky Linux 8 Server L2 v1.0.0Unix
4.1.3.12 Ensure login and logout events are collectedCIS Rocky Linux 9 Server L2 v1.0.0Unix
4.1.3.12 Ensure login and logout events are collected - /var/run/faillockCIS Ubuntu Linux 22.04 LTS Server L2 v.1.0.0Unix
4.1.3.12 Ensure login and logout events are collected - auditctl faillockCIS Oracle Linux 8 Server L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - auditctl lastlogCIS AlmaLinux OS 8 Server L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - faillockCIS Oracle Linux 8 Workstation L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - faillockCIS Red Hat EL8 Workstation L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - faillockCIS AlmaLinux OS 8 Workstation L2 v2.0.0Unix
4.1.3.12 Ensure login and logout events are collected - lastlogCIS AlmaLinux OS 8 Server L2 v2.0.0Unix
4.1.7 Ensure login and logout events are collected - /var/log/faillogCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/faillogCIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/faillogCIS CentOS 7 v3.1.2 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - /var/log/tallylogCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/log/tallylogCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - /var/log/tallylogCIS CentOS 7 v3.1.2 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillockCIS Amazon Linux 2 v2.0.0 L2Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillock/CIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillock/CIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - /var/run/faillock/CIS Oracle Linux 7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/faillogCIS SUSE Linux Enterprise Server 12 L2 v3.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/lastlogCIS SUSE Linux Enterprise Server 12 L2 v3.0.0Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylogCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylogCIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylogCIS CentOS 7 v3.1.1 Workstation L2Unix
4.1.7 Ensure login and logout events are collected - auditctl /var/log/tallylogCIS CentOS 7 v3.1.2 Workstation L2Unix
4.1.8 Ensure session initiation information is collected - /var/log/btmpCIS Amazon Linux 2 v2.0.0 L2Unix
4.1.8 Ensure session initiation information is collected - /var/run/utmpCIS SUSE Linux Enterprise Workstation 12 L2 v3.0.0Unix
4.1.8 Ensure session initiation information is collected - auditctl /var/run/utmpCIS Amazon Linux 2 v2.0.0 L2Unix
4.1.8 Ensure session initiation information is collected - auditctl btmpCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - auditctl btmpCIS CentOS 7 v3.1.2 Server L2Unix
4.1.8 Ensure session initiation information is collected - auditctl wtmpCIS Red Hat EL7 Workstation L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - auditctl wtmpCIS CentOS 7 v3.1.2 Server L2Unix
4.1.8 Ensure session initiation information is collected - utmpCIS Oracle Linux 7 Workstation L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - wtmpCIS Red Hat EL7 Server L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - wtmpCIS Oracle Linux 7 Server L2 v3.1.1Unix
4.1.8 Ensure session initiation information is collected - wtmpCIS CentOS 7 v3.1.1 Server L2Unix
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + NGWindows
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BLWindows
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BLWindows
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BL + NGWindows
17.5.4 Ensure 'Audit Logoff' is set to include 'Success'CIS Microsoft Windows Server 2016 STIG NG MS L3 v1.0.0Windows
17.5.4 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BL + NGWindows
17.5.5 Ensure 'Audit Logon' is set to 'Success and Failure'CIS Microsoft Windows Server 2016 STIG DC L1 v1.0.0Windows
17.5.5 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BLWindows
17.5.5 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BL + NGWindows
17.5.6 Ensure 'Audit Special Logon' is set to include 'Success'CIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + BL + NGWindows