Item Search

Name	Audit Name	Plugin	Category
Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers.d	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure discard services are not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure discretionary access control permission modification events are collected - auditctl b32 setxattr	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - audit.rules b64 adjtimex	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - /etc/issue	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - b64 sethostname	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - auditctl /etc/passwd	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure filesystem integrity is regularly checked	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND INFORMATION INTEGRITY
Ensure mail transfer agent is configured for local-only mode - main.cf	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mail transfer agent is configured for local-only mode - netstat listening	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of FAT filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of jffs2 filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of squashfs filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of squashfs filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure no duplicate UIDs exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure no unconfined daemons exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure no ungrouped files or directories exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure no users have .forward files	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure no users have .netrc files	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure noexec option set on /tmp partition	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure ntp is configured - OPTIONS or ExecStart -u ntp:ntp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure only approved MAC algorithms are used	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure packet redirect sending is disabled - /etc/sysctl ipv4 all send	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure password creation requirements are configured - /etc/pam.d/* lcredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - /etc/pam.d/* try_first_pass	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/cron.d are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/cron.monthly are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/gshadow are configured - permissions	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/issue are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/issue.net are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/passwd are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/shadow- are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/ssh/sshd_config are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on all logfiles are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure remote rsyslog messages are only accepted on designated log hosts - InputTCPServerRun	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure remote syslog-ng messages are only accepted on designated log hosts	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure root is the only UID 0 account	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure rsyslog default file permissions configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure rsyslog is configured to send logs to a remote log host	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure rsyslog or syslog-ng is installed	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure separate partition exists for /home	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure separate partition exists for /tmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure session initiation information is collected - auditctl utmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure session initiation information is collected - utmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure sticky bit is set on all world-writable directories	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure system administrator actions (sudolog) are collected	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure system administrator actions (sudolog) are collected - auditctl	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure telnet client is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure unsuccessful unauthorized file access attempts are collected - auditctl b64 EPERM	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure unsuccessful unauthorized file access attempts are collected - b32 EPERM	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY

Detections

Analytics

Item Search