Detections
Analytics

Item Search

NameAudit NamePluginCategory
3.1 Ensure a fully-synchronized High Availability peer is configuredCIS Palo Alto Firewall 9 Benchmark v1.0.0 L1Palo_Alto
3.1.1 Ensure IP forwarding is disabled - /etc/sysctlCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.1.2 Ensure packet redirect sending is disabled - /etc/sysctl ipv4 all sendCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.1.2 Ensure packet redirect sending is disabled - /etc/sysctl ipv4 default sendCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.1.2 Ensure packet redirect sending is disabled - sysctl ipv4 all sendCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.1.2 Set 'no ip proxy-arp'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.1.3 Set 'no interface tunnel'CIS Cisco IOS 16 L1 v1.1.1Cisco
3.1.4 Set 'ip verify unicast source reachable-via'CIS Cisco IOS 16 L1 v1.1.1Cisco
3.2 Ensure 'High Availability' requires Link Monitoring and/or Path Monitoring - Link Monitoring Failure ConditionCIS Palo Alto Firewall 9 Benchmark v1.0.0 L1Palo_Alto
3.2 Ensure 'High Availability' requires Link Monitoring and/or Path Monitoring - Path Monitoring Failure ConditionCIS Palo Alto Firewall 9 Benchmark v1.0.0 L1Palo_Alto
3.2.1 Ensure source routed packets are not accepted - /etc/sysctl ipv4 default acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.2.1 Ensure source routed packets are not accepted - sysctl ipv4 all accceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.2.1 Ensure source routed packets are not accepted - sysctl ipv4 default acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Default deny configured'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Default deny configured'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 0.0.0.0'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 0.0.0.0'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 10.0.0.0'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 10.0.0.0'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 169.254.0.0'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 172.16.0.0'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 192.0.2.0'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.1 Set 'ip access-list extended' to Forbid Private Source Addresses from External Networks - 'Deny 192.168.0.0'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.2.2 Ensure ICMP redirects are not accepted - /etc/sysctl ipv4 default acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.2.2 Ensure ICMP redirects are not accepted - sysctl ipv4 all acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.2.2 Set inbound 'ip access-group' on the External InterfaceCIS Cisco IOS 15 L2 v4.1.0Cisco
3.2.3 Ensure secure ICMP redirects are not accepted - sysctl ipv4 default secureCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.3 Ensure 'Passive Link State' and 'Preemptive' are configured appropriately - Passive Link StateCIS Palo Alto Firewall 9 Benchmark v1.0.0 L1Palo_Alto
3.3.1 Ensure IPv6 router advertisements are not accepted - sysctl ipv6 all acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.3.1 Ensure IPv6 router advertisements are not accepted - sysctl ipv6 default acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.3.1.1 Set 'key chain'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.1.1 Set 'key chain'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.1.3 Set 'key-string'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.1.3 Set 'key-string'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.1.4 Set 'address-family ipv4 autonomous-system'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.1.4 Set 'address-family ipv4 autonomous-system'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.1.5 Set 'af-interface default'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.1.6 Set 'authentication key-chain'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.1.7 Set 'authentication mode md5'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.1.7 Set 'authentication mode md5'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.1.7 Set 'authentication mode md5'CIS Cisco IOS 16 L1 v1.1.1Cisco
3.3.1.8 Set 'ip authentication key-chain eigrp'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.2 Ensure IPv6 redirects are not accepted - /etc/sysctl ipv6 all acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.3.2 Ensure IPv6 redirects are not accepted - sysctl ipv6 default acceptCIS SUSE Linux Enterprise Server 11 L1 v2.1.0Unix
3.3.2.1 Set 'authentication message-digest' for OSPF areaCIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.2.1 Set 'authentication message-digest' for OSPF areaCIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.3.2 Set 'key'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.3.3 Set 'key-string'CIS Cisco IOS 16 L2 v1.1.1Cisco
3.3.3.3 Set 'key-string'CIS Cisco IOS 15 L2 v4.1.0Cisco
3.3.3.5 Set 'ip rip authentication mode' to 'md5'CIS Cisco IOS 15 L2 v4.1.0Cisco