| 1.46 APPL-14-001024 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.50 APPL-26-001044 | CIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 1.51 APPL-15-001044 | CIS Apple macOS 15 Sequoia STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 1.59 WN10-AU-000045 | CIS Microsoft Windows 10 STIG v1.0.0 CAT II | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.59 WN11-AU-000045 | CIS Microsoft Windows 11 STIG v1.2.0 CAT II | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.60 WN10-AU-000050 | CIS Microsoft Windows 10 STIG v1.0.0 CAT II | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.60 WN11-AU-000050 | CIS Microsoft Windows 11 STIG v1.2.0 CAT II | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 1.68 PHTN-40-000204 | CIS VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v1.0.0 CAT II | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 1.446 OL09-00-008000 | CIS Oracle Linux 9 STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.9 Ensure file deletion events by users are collected - rename 32 bit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.9 Ensure file deletion events by users are collected - rename 64 bit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.9 Ensure file deletion events by users are collected - renameat 32 bit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.9 Ensure file deletion events by users are collected - renameat 64 bit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.26 Ensure audit of the rmdir syscall | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.27 Ensure audit of unlink syscall | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.28 Ensure audit unlinkat syscall | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.33 Ensure audit of semanage command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.34 Ensure audit of the setsebool command. | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.35 Ensure audit of the chcon command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.39 Ensure audit of setfiles command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| ALMA-09-046770 - AlmaLinux OS 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. | DISA Cloud Linux AlmaLinux OS 9 STIG v1r7 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| APPL-14-001024 - The macOS system must be configured to audit all failed program execution on the system. | DISA Apple macOS 14 Sonoma STIG v2r4 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| AZLX-23-002160 - Amazon Linux 2023 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. | DISA Amazon Linux 2023 STIG v1r4 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| OL09-00-000720 - OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. | DISA Oracle Linux 9 STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| OL09-00-000725 - OL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. | DISA Oracle Linux 9 STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| PHTN-30-000020 - The Photon operating system must generate audit records when successful/unsuccessful attempts to access privileges occur. | DISA STIG VMware vSphere 7.0 Photon OS v1r4 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| PHTN-40-000204 - The Photon operating system must audit all account modifications. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r2 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| RHEL-07-030810 - The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command. | DISA Red Hat Enterprise Linux 7 STIG v3r15 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-07-030830 - The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall. | DISA Red Hat Enterprise Linux 7 STIG v3r15 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-07-030840 - The Red Hat Enterprise Linux operating system must audit all uses of the kmod command. | DISA Red Hat Enterprise Linux 7 STIG v3r15 | Unix | AUDIT AND ACCOUNTABILITY |
| RHEL-09-654250 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. | DISA Red Hat Enterprise Linux 9 STIG v2r9 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| RHEL-10-500750 - RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock". | DISA Red Hat Enterprise Linux 10 STIG v1r2 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| SPLK-CL-000280 - Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report. | DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API | Splunk | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010316 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chfn command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010318 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the umount command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010321 - The Ubuntu operating system must generate audit records for any usage of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010341 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the sudoedit command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010344 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chcon command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010350 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the gpasswd command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010351 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the chage command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-18-010352 - The Ubuntu operating system must generate audit records for successful/unsuccessful uses of the usermod command. | DISA STIG Ubuntu 18.04 LTS v2r15 | Unix | AUDIT AND ACCOUNTABILITY |
| UBTU-20-010244 - The Ubuntu operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. | DISA Canonical Ubuntu 20.04 LTS STIG v2r4 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| UBTU-24-500010 - Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access. | DISA Canonical Ubuntu 24.04 LTS STIG v1r6 | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| WN11-00-000065 - Unused accounts must be disabled or removed from the system after 35 days of inactivity. | DISA Microsoft Windows 11 STIG v2r9 | Windows | AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION |
| WN11-AU-000050 - The system must be configured to audit Detailed Tracking - Process Creation successes. | DISA Microsoft Windows 11 STIG v2r9 | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| WN12-AU-000089 - The system must be configured to audit Policy Change - Authorization Policy Change successes. | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | AUDIT AND ACCOUNTABILITY |
| WN25-AU-000300 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes. | DISA Microsoft Windows Server 2025 STIG v1r3 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000300 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000310 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures. | DISA Microsoft Windows Server 2025 STIG v1r3 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-AU-000310 - Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
