Detections
Analytics

Revision 1.2Jul 2, 2026

Informational Update
  • 1.1.1.6 Ensure overlay kernel module is not available
  • 1.1.1.7 Ensure squashfs kernel module is not available
  • 1.1.1.8 Ensure udf kernel module is not available
  • 1.2.1.2 Ensure weak dependencies are configured
  • 1.5.2 Ensure fs.protected_symlinks is configured
  • 2.1.21 Ensure X window server services are not in use
  • 3.3.1.1 Ensure net.ipv4.ip_forward is configured
  • 4.1.4 Ensure ufw outgoing default is configured
  • 5.1.8 Ensure sshd DisableForwarding is enabled
  • 5.1.9 Ensure sshd GSSAPIAuthentication is disabled
  • 5.4.1.2 Ensure minimum password days is configured
  • 6.1.2.10 Ensure rsyslog forwarding uses gtls
  • 6.1.2.11 Ensure rsyslog CA certificates are configured
  • 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled
  • 6.2.1.4 Ensure audit_backlog_limit is configured
  • 6.2.3.1 Ensure modification of the /etc/sudoers file is collected
  • 6.2.3.10 Ensure use of privileged commands are collected
  • 6.2.3.11 Ensure unsuccessful file access attempts are collected
  • 6.2.3.12 Ensure events that modify /etc/group information are collected
  • 6.2.3.13 Ensure events that modify /etc/passwd information are collected
  • 6.2.3.14 Ensure events that modify /etc/shadow and /etc/gshadow are collected
  • 6.2.3.15 Ensure events that modify /etc/security/opasswd are collected
  • 6.2.3.16 Ensure events that modify /etc/nsswitch.conf file are collected
  • 6.2.3.17 Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected
  • 6.2.3.18 Ensure discretionary access control permission modification events chmod,fchmod,fchmodat,fchmodat2 are collected
  • 6.2.3.19 Ensure discretionary access control permission modification events chown,fchown,lchown,fchownat are collected
  • 6.2.3.2 Ensure actions as another user are always logged
  • 6.2.3.20 Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected
  • 6.2.3.21 Ensure successful file system mounts are collected
  • 6.2.3.22 Ensure session initiation information is collected
  • 6.2.3.23 Ensure login and logout events are collected
  • 6.2.3.24 Ensure unlink file deletion events by users are collected
  • 6.2.3.25 Ensure rename file deletion events by users are collected
  • 6.2.3.26 Ensure events that modify the system's Mandatory Access Controls are collected
  • 6.2.3.27 Ensure successful and unsuccessful attempts to use the chcon command are collected
  • 6.2.3.28 Ensure successful and unsuccessful attempts to use the setfacl command are collected
  • 6.2.3.29 Ensure successful and unsuccessful attempts to use the chacl command are collected
  • 6.2.3.3 Ensure events that modify the sudo log file are collected
  • 6.2.3.30 Ensure successful and unsuccessful attempts to use the usermod command are collected
  • 6.2.3.31 Ensure kernel module loading unloading and modification is collected
  • 6.2.3.32 Ensure kernel \"init_module\" and \"finit_module\" loading unloading and modification is collected
  • 6.2.3.33 Ensure kernel \"delete_module\" loading unloading and modification is collected
  • 6.2.3.34 Ensure kernel query_module loading unloading and modification is collected
  • 6.2.3.35 Ensure the audit configuration is loaded regardless of errors
  • 6.2.3.36 Ensure the audit configuration is immutable
  • 6.2.3.37 Ensure the running and on disk configuration is the same
  • 6.2.3.4 Ensure events that modify date and time information are collected
  • 6.2.3.5 Ensure events that modify sethostname and setdomainname are collected
  • 6.2.3.6 Ensure events that modify /etc/issue and /etc/issue.net are collected
  • 6.2.3.7 Ensure events that modify /etc/hosts and /etc/hostname are collected
  • 6.2.3.8 Ensure events that modify the system's network environment are collected
  • 6.2.3.9 Ensure events that modify /etc/NetworkManager directory are collected
  • 6.2.4.1 Ensure audit log files mode is configured
  • 6.2.4.2 Ensure audit log files owner is configured
  • 6.2.4.3 Ensure audit log files group owner is configured
  • 6.2.4.4 Ensure the audit log file directory mode is configured
  • 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tools
Miscellaneous
  • Platform check updated.
  • References updated.
Added
  • CIS_Debian_Linux_13_v1.0.0_L2_Server.audit from CIS Debian Linux 13 v1.0.0
Removed
  • CIS_Debian_Linux_13_v1.0.0_L2_Server.audit from CIS Debian Linux 13 1.0.0