CCI|CCI-003831

Title

Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Reference Item Details

Reference: CCI - DISA Control Correlation Identifier

Category: 2024

Audit Items

View all Reference Audit Items

Name	Plugin	Audit Name
CASA-ND-000930 - The Cisco ASA must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts - logging host	Cisco	DISA STIG Cisco ASA NDM v2r1
CASA-ND-000930 - The Cisco ASA must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts - logging trap	Cisco	DISA STIG Cisco ASA NDM v2r1
CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco IOS Router NDM v3r1
CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco IOS XE Router NDM v3r1
CISC-ND-001000 - The Cisco router must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco IOS-XR Router NDM v3r1
CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco NX-OS Switch NDM v3r1
CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco IOS XE Switch NDM v3r1
CISC-ND-001000 - The Cisco switch must be configured to generate an alert for all audit failure events.	Cisco	DISA STIG Cisco IOS Switch NDM v3r1
JUEX-NM-000640 - The Juniper EX switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.	Juniper	DISA Juniper EX Series Network Device Management v2r1
JUNI-ND-000990 - The Juniper router must be configured to generate an alert for all audit failure events.	Juniper	DISA STIG Juniper Router NDM v3r1
JUSX-DM-000095 - The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.	Juniper	DISA Juniper SRX Services Gateway NDM v3r1
PANW-NM-000097 - The Palo Alto Networks security platform must have alarms enabled.	Palo_Alto	DISA STIG Palo Alto NDM v3r1
PANW-NM-000131 - The Palo Alto Networks security platform must use automated mechanisms to alert security personnel to threats identified by authoritative sources (e.g., CTOs) and IAW CJCSM 6510.01B.	Palo_Alto	DISA STIG Palo Alto NDM v3r1
SPLK-CL-000140 - Splunk Enterprise must allow only the individuals appointed by the information system security manager (ISSM) to have full admin rights to the system - ISSM to have full admin rights to the system.	Splunk	DISA STIG Splunk Enterprise 8.x for Linux v2r1 STIG REST API
SPLK-CL-000270 - Splunk Enterprise must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to be assigned to the Power User role - or individuals or roles appointed by the ISSM to be assigned to the Power User role.	Splunk	DISA STIG Splunk Enterprise 7.x for Windows v3r1 REST API
TCAT-AS-001731 - The application server must alert the system administrator (SA) and information system security offer (ISSO), at a minimum, in the event of a log processing failure.	Unix	DISA STIG Apache Tomcat Application Server 9 v3r1 Middleware