Detections
Analytics

CCI|CCI-002884

Title

Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
3.500 - The system must audit all uses of the creat syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.500 - The system must audit all uses of the creat syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.500 - The system must audit all uses of the creat syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.500 - The system must audit all uses of the creat syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.510 - The system must audit all uses of the open syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.510 - The system must audit all uses of the open syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.510 - The system must audit all uses of the open syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.510 - The system must audit all uses of the open syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.520 - The system must audit all uses of the openat syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.520 - The system must audit all uses of the openat syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.520 - The system must audit all uses of the openat syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.520 - The system must audit all uses of the openat syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.530 - The system must audit all uses of the open_by_handle_at syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.530 - The system must audit all uses of the open_by_handle_at syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.530 - The system must audit all uses of the open_by_handle_at syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.530 - The system must audit all uses of the open_by_handle_at syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.540 - The system must audit all uses of the truncate syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.540 - The system must audit all uses of the truncate syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.540 - The system must audit all uses of the truncate syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.540 - The system must audit all uses of the truncate syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.550 - The system must audit all uses of the ftruncate syscall - EACCES 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.550 - The system must audit all uses of the ftruncate syscall - EACCES 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.550 - The system must audit all uses of the ftruncate syscall - EPERM 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.550 - The system must audit all uses of the ftruncate syscall - EPERM 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.590 - The system must audit all uses of the setfiles command.UnixTenable Fedora Linux Best Practices v2.0.0
3.740 - The system must audit all uses of the mount command and syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.740 - The system must audit all uses of the mount command and syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.740 - The system must audit all uses of the mount command and syscall.UnixTenable Fedora Linux Best Practices v2.0.0
3.880 - The system must audit all uses of the rename syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.880 - The system must audit all uses of the rename syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.890 - The system must audit all uses of the renameat syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.890 - The system must audit all uses of the renameat syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.900 - The system must audit all uses of the rmdir syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.900 - The system must audit all uses of the rmdir syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.910 - The system must audit all uses of the unlink syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.910 - The system must audit all uses of the unlink syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.920 - The system must audit all uses of the unlinkat syscall - 32 bitUnixTenable Fedora Linux Best Practices v2.0.0
3.920 - The system must audit all uses of the unlinkat syscall - 64 bitUnixTenable Fedora Linux Best Practices v2.0.0
4.1.3.10 Ensure use of privileged commands is collectedUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - creat EACCES 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - creat EACCES 64 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - creat EPERM 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - creat EPERM 64 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - ftruncate EACCES 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - ftruncate EACCES 64 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - ftruncate EPERM 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - ftruncate EPERM 64 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - open EACCES 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - open EACCES 64 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - open EPERM 32 bitUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG