Mar 18, 2024 Functional Update- 3.1.2 Ensure wireless interfaces are disabled
Added- 4.1.3.6 Ensure use of privileged commands are collected
Removed- 4.1.3.6 Ensure use of privileged commands are collected - /etc/audit/rules.d
- 4.1.3.6 Ensure use of privileged commands are collected - auditctl
|
Mar 11, 2024 |
Mar 7, 2024 Added- 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded
Removed- 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
- 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
|
Nov 17, 2023 Functional Update- 5.2.16 Ensure SSH AllowTcpForwarding is disabled
|
Oct 24, 2023 Functional Update- 5.2.16 Ensure SSH AllowTcpForwarding is disabled
|
Sep 19, 2023 Functional Update- 4.1.3.10 Ensure successful file system mounts are collected - 32-bit
- 4.1.3.10 Ensure successful file system mounts are collected - 64-bit
- 4.1.3.11 Ensure session initiation information is collected - auditctl btmp
- 4.1.3.11 Ensure session initiation information is collected - auditctl wtmp
- 4.1.3.11 Ensure session initiation information is collected - btmp
- 4.1.3.11 Ensure session initiation information is collected - wtmp
- 4.1.3.13 Ensure file deletion events by users are collected - 32-bit
- 4.1.3.13 Ensure file deletion events by users are collected - 64-bit
- 4.1.3.13 Ensure file deletion events by users are collected - auditctl (32-bit)
- 4.1.3.13 Ensure file deletion events by users are collected - auditctl (64-bit)
- 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - /etc/audit/rules.d/*.rules
- 4.1.3.17 Ensure successful and unsuccessful attempts to use the chacl command are recorded - auditctl
- 4.1.3.4 Ensure events that modify date and time information are collected - /etc/localtime
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl /etc/localtime
- 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl network
- 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
- 4.1.3.5 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
Added- 4.1.3.12 Ensure login and logout events are collected - /var/run/faillock
- 4.1.3.12 Ensure login and logout events are collected - auditctl /var/run/faillock
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - /usr/bin/kmod (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl /usr/bin/kmod (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modules (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - kmod symlinks (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modules (64-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - (64-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - audiitctl (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl (64-bit)
- 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network/
- 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/networks
- 4.1.3.5 Ensure events that modify the system's network environment are collected - auditctl networks
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b32
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES b64
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b32
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM b64
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b32
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES b64
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b32
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM b64
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chmod/fchmod/fchmodat
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 chown/fchown/fchownat/lchown
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr/lsetxattr/fsetxattr/removexattr
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chmod/fchmod/fchmodat
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 chown/fchown/fchownat/lchown
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - b64 setxattr/lsetxattr/fsetxattr/removexattr
Removed- 4.1.3.12 Ensure login and logout events are collected - /var/log/faillog
- 4.1.3.12 Ensure login and logout events are collected - /var/log/tallylog
- 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/faillog
- 4.1.3.12 Ensure login and logout events are collected - auditctl /var/log/tallylog
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (32-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl init_module/delete_module (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl insmod
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl modprobe
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - auditctl rmmod
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (64-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - init_module/delete_module (32-bit)
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - insmod
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - modprobe
- 4.1.3.19 Ensure kernel module loading unloading and modification is collected - rmmod
- 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - adjtimex (64-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (32-bit)
- 4.1.3.4 Ensure events that modify date and time information are collected - clock_settime (64-bit)
- 4.1.3.5 Ensure events that modify the system's network environment are collected - /etc/network
- 4.1.3.6 Ensure use of privileged commands are collected
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EACCES (64-bit)
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - EPERM (64-bit)
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EACCES (64-bit)
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM
- 4.1.3.7 Ensure unsuccessful file access attempts are collected - auditctl EPERM (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)
- 4.1.3.9 Ensure discretionary access control permission modification events are collected - xattr (64-bit)
|
Aug 24, 2023 Added- 1.1.1.2 Ensure mounting of squashfs filesystems is disabled
- 1.1.1.3 Ensure mounting of udf filesystems is disabled
Removed- 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - blacklist
- 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - lsmod
- 1.1.1.2 Ensure mounting of squashfs filesystems is disabled - modprobe
- 1.1.1.3 Ensure mounting of udf filesystems is disabled - blacklist
- 1.1.1.3 Ensure mounting of udf filesystems is disabled - lsmod
- 1.1.1.3 Ensure mounting of udf filesystems is disabled - modprobe
|
Jul 5, 2023 Functional Update- 4.1.2.3 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'
- 4.1.2.3 Ensure system is disabled when audit logs are full - 'space_left_action = email'
|
Jun 23, 2023 Functional Update- 4.1.3.10 Ensure successful file system mounts are collected - 64-bit
|
Jun 20, 2023 Functional Update- 4.1.3.15 Ensure successful and unsuccessful attempts to use the chcon command are recorded - /etc/audit/rules.d/*.rules
- 4.1.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are recorded - /etc/audit/rules.d/*.rules
|
