Detections
Analytics

Revision 1.12

Sep 19, 2023
Functional Update
  • 4.1.3.10 Ensure successful file system mounts are collected - 32-bit
  • 4.1.3.10 Ensure successful file system mounts are collected - 64-bit
  • 4.1.3.11 Ensure session initiation information is collected - auditctl btmp
  • 4.1.3.11 Ensure session initiation information is collected - auditctl wtmp
  • 4.1.3.11 Ensure session initiation information is collected - btmp
  • 4.1.3.11 Ensure session initiation information is collected - wtmp
  • 4.1.3.13 Ensure file deletion events by users are collected - 32-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - 64-bit
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (32-bit)
  • 4.1.3.13 Ensure file deletion events by users are collected - auditctl (64-bit)
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
  • 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
  • 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl network
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
Informational Update
  • 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
Miscellaneous
  • Metadata updated.
Added
  • 4.1.3.12 Ensure login and logout events are collected - /var/run/faillock
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/run/faillock
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl /usr/bin/kmod (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modules (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modules (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - audiitctl (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl (64-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network/
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/networks
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl networks
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b64
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b32
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b64
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr/removexattr
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/fchownat/lchown
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
Removed
  • 4.1.3.12 Ensure login and logout events are collected - /var/log/faillog
  • 4.1.3.12 Ensure login and logout events are collected - /var/log/tallylog
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/faillog
  • 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/tallylog
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (32-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl insmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modprobe
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl rmmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (64-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (32-bit)
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - insmod
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modprobe
  • 4.1.3.19 Ensure kernel module loading unloading and modification is collected - rmmod
  • 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (32-bit)
  • 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (64-bit)
  • 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network
  • 4.1.3.6 Ensure use of privileged commands are collected
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES (64-bit)
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM
  • 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)
  • 4.1.3.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)