Detections
Analytics

CCI|CCI-003938

Title

Automatically generate audit records of the enforcement actions.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-002107 - AIX must disable Kerberos Authentication in ssh config file to enforce access restrictions.UnixDISA STIG AIX 7.x v3r1
AIX7-00-002133 - AIX must be configured to use syslogd to log events by TCPD.UnixDISA STIG AIX 7.x v3r1
AIX7-00-003022 - AIX must disable trivial file transfer protocol.UnixDISA STIG AIX 7.x v3r1
APPL-14-001001 - The macOS system must be configured to audit all administrative action events.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-001003 - The macOS system must enable security auditing.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-001020 - The macOS system must be configured to audit all deletions of object attributes.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-001021 - The macOS system must be configured to audit all changes of object attributes.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-001024 - The macOS system must be configured to audit all failed program execution on the system.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-14-001044 - The macOS system must configure the system to audit all authorization and authentication events.UnixDISA Apple macOS 14 (Sonoma) STIG v2r2
APPL-15-001001 - The macOS system must be configured to audit all administrative action events.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001003 - The macOS system must enable security auditing.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001020 - The macOS system must be configured to audit all deletions of object attributes.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001021 - The macOS system must be configured to audit all changes of object attributes.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001022 - The macOS system must be configured to audit all failed read actions on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001023 - The macOS system must be configured to audit all failed write actions on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001024 - The macOS system must be configured to audit all failed program execution on the system.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-001044 - The macOS system must be configured to audit all authorization and authentication events.UnixDISA Apple macOS 15 (Sequoia) STIG v1r1
CD12-00-004100 - PostgreSQL must produce audit records of its enforcement of access restrictions associated with changes to the configuration of PostgreSQL or database(s).PostgreSQLDBDISA STIG Crunchy Data PostgreSQL DB v3r1
CNTR-R2-000060 Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.UnixDISA Rancher Government Solutions RKE2 STIG v2r2
EPAS-00-008600 - The EDB Postgres Advanced Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).PostgreSQLDBEnterpriseDB PostgreSQL Advanced Server DB v2r1
EX19-ED-000198 - The Exchange local machine policy must require signed scripts.WindowsDISA Microsoft Exchange 2019 Edge Server STIG v2r1
EX19-MB-000197 - Exchange software must be monitored for unauthorized changes.WindowsDISA Microsoft Exchange 2019 Mailbox Server STIG v2r2
MADB-10-008000 - MariaDB must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the DBMS or database(s).MySQLDBDISA MariaDB Enterprise 10.x v2r2 DB
MYS8-00-009300 - The MySQL Database Server 8.0 must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the MySQL Database Server 8.0 or database(s).MySQLDBDISA Oracle MySQL 8.0 v2r2 DB
OL07-00-030000 - The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.UnixDISA Oracle Linux 7 STIG v3r1
OL08-00-030180 - The OL 8 audit package must be installed.UnixDISA Oracle Linux 8 STIG v2r2
OL08-00-030181 - OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.UnixDISA Oracle Linux 8 STIG v2r2
PHTN-40-000016 The Photon operating system must enable the auditd service.UnixDISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r1
RHEL-09-653010 - RHEL 9 audit package must be installed.UnixDISA Red Hat Enterprise Linux 9 STIG v2r2
RHEL-09-653015 - RHEL 9 audit service must be enabled.UnixDISA Red Hat Enterprise Linux 9 STIG v2r2
SLES-12-020000 - The SUSE operating system must have the auditing package installed.UnixDISA SLES 12 STIG v3r1
SLES-12-020240 - The SUSE operating system must generate audit records for all uses of the privileged functions.UnixDISA SLES 12 STIG v3r1
SLES-15-030640 - The SUSE operating system must generate audit records for all uses of the privileged functions.UnixDISA SLES 15 STIG v2r2
SLES-15-030650 - The SUSE operating system must have the auditing package installed.UnixDISA SLES 15 STIG v2r2
SQL6-D0-011800 - SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).MS_SQLDBDISA STIG SQL Server 2016 Instance DB Audit v3r2
TCAT-AS-001560 - AccessLogValve must be configured for Catalina engine.UnixDISA STIG Apache Tomcat Application Server 9 v3r1 Middleware
UBTU-22-653010 - Ubuntu 22.04 LTS must have the 'auditd' package installed.UnixDISA STIG Canonical Ubuntu 22.04 LTS v2r2
UBTU-22-653015 - Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.UnixDISA STIG Canonical Ubuntu 22.04 LTS v2r2
WN10-AU-000045 - The system must be configured to audit Detailed Tracking - PNP Activity successes.WindowsDISA Windows 10 STIG v3r2
WN10-AU-000050 - The system must be configured to audit Detailed Tracking - Process Creation successes.WindowsDISA Windows 10 STIG v3r2
WN11-AU-000045 - The system must be configured to audit Detailed Tracking - PNP Activity successes.WindowsDISA Windows 11 STIG v2r2
WN11-AU-000050 - The system must be configured to audit Detailed Tracking - Process Creation successes.WindowsDISA Windows 11 STIG v2r2