Detections
Analytics

CCI|CCI-003938

Title

Automatically generate audit records of the enforcement actions.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
APPL-14-001001 - The macOS system must be configured to audit all administrative action events.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001003 - The macOS system must enable security auditing.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001020 - The macOS system must be configured to audit all deletions of object attributes.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001021 - The macOS system must be configured to audit all changes of object attributes.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001024 - The macOS system must be configured to audit all failed program execution on the system.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001044 - The macOS system must configure the system to audit all authorization and authentication events.UnixDISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-15-001001 - The macOS system must be configured to audit all administrative action events.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001003 - The macOS system must enable security auditing.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001020 - The macOS system must be configured to audit all deletions of object attributes.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001021 - The macOS system must be configured to audit all changes of object attributes.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001022 - The macOS system must be configured to audit all failed read actions on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001023 - The macOS system must be configured to audit all failed write actions on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001024 - The macOS system must be configured to audit all failed program execution on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001044 - The macOS system must be configured to audit all authorization and authentication events.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
CD12-00-004100 - PostgreSQL must produce audit records of its enforcement of access restrictions associated with changes to the configuration of PostgreSQL or database(s).PostgreSQLDBDISA STIG Crunchy Data PostgreSQL DB v3r1
EPAS-00-008600 - The EDB Postgres Advanced Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).PostgreSQLDBEnterpriseDB PostgreSQL Advanced Server DB v2r1
EX19-ED-000198 The Exchange local machine policy must require signed scripts.WindowsDISA Microsoft Exchange 2019 Edge Server STIG v2r1
EX19-MB-000197 Exchange software must be monitored for unauthorized changes.WindowsDISA Microsoft Exchange 2019 Mailbox Server STIG v2r1
MADB-10-008000 - MariaDB must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the DBMS or database(s).MySQLDBDISA MariaDB Enterprise 10.x v2r1 DB
MYS8-00-009300 - The MySQL Database Server 8.0 must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the MySQL Database Server 8.0 or database(s).MySQLDBDISA Oracle MySQL 8.0 v2r1 DB
OL08-00-030180 - The OL 8 audit package must be installed.UnixDISA Oracle Linux 8 STIG v2r1
OL08-00-030181 - OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.UnixDISA Oracle Linux 8 STIG v2r1
PHTN-40-000016 The Photon operating system must enable the auditd service.UnixDISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r1
RHEL-09-653010 - RHEL 9 audit package must be installed.UnixDISA Red Hat Enterprise Linux 9 STIG v2r2
RHEL-09-653015 - RHEL 9 audit service must be enabled.UnixDISA Red Hat Enterprise Linux 9 STIG v2r2
SLES-15-030640 - The SUSE operating system must generate audit records for all uses of the privileged functions.UnixDISA SLES 15 STIG v2r1
SLES-15-030650 - The SUSE operating system must have the auditing package installed.UnixDISA SLES 15 STIG v2r1
SQL6-D0-011800 - SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).MS_SQLDBDISA STIG SQL Server 2016 Instance DB Audit v3r1
TCAT-AS-001560 - AccessLogValve must be configured for Catalina engine.UnixDISA STIG Apache Tomcat Application Server 9 v3r1 Middleware
UBTU-22-653010 - Ubuntu 22.04 LTS must have the 'auditd' package installed.UnixDISA STIG Canonical Ubuntu 22.04 LTS v2r2
UBTU-22-653015 - Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.UnixDISA STIG Canonical Ubuntu 22.04 LTS v2r2
WN10-AU-000045 - The system must be configured to audit Detailed Tracking - PNP Activity successes.WindowsDISA Windows 10 STIG v3r2
WN10-AU-000050 - The system must be configured to audit Detailed Tracking - Process Creation successes.WindowsDISA Windows 10 STIG v3r2
WN11-AU-000045 - The system must be configured to audit Detailed Tracking - PNP Activity successes.WindowsDISA Windows 11 STIG v2r2
WN11-AU-000050 - The system must be configured to audit Detailed Tracking - Process Creation successes.WindowsDISA Windows 11 STIG v2r2