CCI|CCI-004188

Monitor the use of maintenance tools that execute with increased privilege.

Reference: CCI - DISA Control Correlation Identifier

Category: 2024

Name	Plugin	Audit Name
APPL-14-001001 - The macOS system must be configured to audit all administrative action events.	Unix	DISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-001003 - The macOS system must enable security auditing.	Unix	DISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-15-001003 - The macOS system must enable security auditing.	Unix	DISA Apple macOS 15 (Sequoia) STIG v1r1
OL08-00-030181 - OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.	Unix	DISA Oracle Linux 8 STIG v2r1
RHEL-09-653015 - RHEL 9 audit service must be enabled.	Unix	DISA Red Hat Enterprise Linux 9 STIG v2r2
SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.	Unix	DISA STIG Solaris 11 X86 v3r1
SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.	Unix	DISA STIG Solaris 11 SPARC v3r1
UBTU-22-654235 - Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.	Unix	DISA STIG Canonical Ubuntu 22.04 LTS v2r2