DISA_STIG_Solaris_11_SPARC_v2r7.audit from DISA Solaris 11 SPARC v2r7 STIG

SOL-11.1-010040 - The audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.

CAT|II

CCI|CCI-001487

Rule-ID|SV-216246r603267_rule

STIG-ID|SOL-11.1-010040

STIG-Legacy|SV-60657

STIG-Legacy|V-47781

Vuln-ID|V-216246

SOL-11.1-010060 - The audit system must support an audit reduction capability.

CCI|CCI-001877

Rule-ID|SV-219959r854526_rule

STIG-ID|SOL-11.1-010060

STIG-Legacy|SV-60659

STIG-Legacy|V-47783

Vuln-ID|V-219959

SOL-11.1-010070 - The audit system records must be able to be used by a report generation capability.

CCI|CCI-001880

Rule-ID|SV-219960r854527_rule

STIG-ID|SOL-11.1-010070

STIG-Legacy|SV-60661

STIG-Legacy|V-47785

Vuln-ID|V-219960

SOL-11.1-010080 - The operating system must provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

CCI|CCI-000158

Rule-ID|SV-216249r603267_rule

STIG-ID|SOL-11.1-010080

STIG-Legacy|SV-60663

STIG-Legacy|V-47787

Vuln-ID|V-216249

SOL-11.1-010100 - The audit records must provide data for all auditable events defined at the organizational level for the organization-defined information system components.

CCI|CCI-000169

Rule-ID|SV-219961r603267_rule

STIG-ID|SOL-11.1-010100

STIG-Legacy|SV-60665

STIG-Legacy|V-47789

Vuln-ID|V-219961

SOL-11.1-010120 - The operating system must generate audit records for the selected list of auditable events as defined in DoD list of events.

CCI|CCI-000172

Rule-ID|SV-216251r603267_rule

STIG-ID|SOL-11.1-010120

STIG-Legacy|SV-60667

STIG-Legacy|V-47791

Vuln-ID|V-216251

SOL-11.1-010130 - The operating system must support the capability to compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within organization-defined level of tolerance.

Rule-ID|SV-219962r603267_rule

STIG-ID|SOL-11.1-010130

STIG-Legacy|SV-60669

STIG-Legacy|V-47793

Vuln-ID|V-219962

SOL-11.1-010140 - Audit records must include what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-216253r603267_rule

STIG-ID|SOL-11.1-010140

STIG-Legacy|SV-60671

STIG-Legacy|V-47795

Vuln-ID|V-216253

SOL-11.1-010150 - Audit records must include when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-216254r603267_rule

STIG-ID|SOL-11.1-010150

STIG-Legacy|SV-60673

STIG-Legacy|V-47797

Vuln-ID|V-216254

SOL-11.1-010160 - Audit records must include where the events occurred.

CCI|CCI-000132

Rule-ID|SV-216255r603267_rule

STIG-ID|SOL-11.1-010160

STIG-Legacy|SV-60675

STIG-Legacy|V-47799

Vuln-ID|V-216255

SOL-11.1-010170 - Audit records must include the sources of the events that occurred.

CCI|CCI-000133

Rule-ID|SV-216256r603267_rule

STIG-ID|SOL-11.1-010170

STIG-Legacy|SV-60677

STIG-Legacy|V-47801

Vuln-ID|V-216256

SOL-11.1-010180 - Audit records must include the outcome (success or failure) of the events that occurred.

CCI|CCI-000134

Rule-ID|SV-216257r603267_rule

STIG-ID|SOL-11.1-010180

STIG-Legacy|SV-60679

STIG-Legacy|V-47803

Vuln-ID|V-216257

SOL-11.1-010220 - The audit system must be configured to audit file deletions - getpolicy

CCI|CCI-000366

Rule-ID|SV-216258r603267_rule

STIG-ID|SOL-11.1-010220

STIG-Legacy|SV-60681

STIG-Legacy|V-47805

Vuln-ID|V-216258

SOL-11.1-010220 - The audit system must be configured to audit file deletions.

SOL-11.1-010230 - The audit system must be configured to audit account creation - getpolicy

CCI|CCI-000018

Rule-ID|SV-216259r877420_rule

STIG-ID|SOL-11.1-010230

STIG-Legacy|SV-60683

STIG-Legacy|V-47807

Vuln-ID|V-216259

SOL-11.1-010230 - The audit system must be configured to audit account creation.

SOL-11.1-010250 - The audit system must be configured to audit account modification - getpolicy

CCI|CCI-001403

Rule-ID|SV-216260r877423_rule

STIG-ID|SOL-11.1-010250

STIG-Legacy|SV-60685

STIG-Legacy|V-47809

Vuln-ID|V-216260

SOL-11.1-010250 - The audit system must be configured to audit account modification.

SOL-11.1-010260 - The operating system must automatically audit account disabling actions - getpolicy

CCI|CCI-001404

Rule-ID|SV-216261r877426_rule

STIG-ID|SOL-11.1-010260

STIG-Legacy|SV-60687

STIG-Legacy|V-47811

Vuln-ID|V-216261

SOL-11.1-010260 - The operating system must automatically audit account disabling actions.

SOL-11.1-010270 - The operating system must automatically audit account termination - getpolicy

CCI|CCI-001405

Rule-ID|SV-216262r877429_rule

STIG-ID|SOL-11.1-010270

STIG-Legacy|SV-60689

STIG-Legacy|V-47813

Vuln-ID|V-216262

SOL-11.1-010270 - The operating system must automatically audit account termination.

SOL-11.1-010290 - The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked - getpolicy

Rule-ID|SV-216263r877432_rule

STIG-ID|SOL-11.1-010290

STIG-Legacy|SV-60691

STIG-Legacy|V-47815

Vuln-ID|V-216263

SOL-11.1-010290 - The operating system must ensure unauthorized, security-relevant configuration changes detected are tracked.

SOL-11.1-010300 - The audit system must be configured to audit all administrative, privileged, and security actions - getpolicy

Rule-ID|SV-216264r877435_rule

STIG-ID|SOL-11.1-010300

STIG-Legacy|SV-60693

STIG-Legacy|V-47817

Vuln-ID|V-216264

SOL-11.1-010300 - The audit system must be configured to audit all administrative, privileged, and security actions.

SOL-11.1-010310 - The audit system must be configured to audit login, logout, and session initiation - getflags

CAT|III

CCI|CCI-000067

Rule-ID|SV-216265r793024_rule

STIG-ID|SOL-11.1-010310

STIG-Legacy|SV-60695

STIG-Legacy|V-47819

Vuln-ID|V-216265

SOL-11.1-010310 - The audit system must be configured to audit login, logout, and session initiation - getnaflags lo

SOL-11.1-010310 - The audit system must be configured to audit login, logout, and session initiation - getnaflags na

SOL-11.1-010310 - The audit system must be configured to audit login, logout, and session initiation - getpolicy

SOL-11.1-010320 - The audit system must be configured to audit all discretionary access control permission modifications - getpolicy

Rule-ID|SV-219963r603267_rule

STIG-ID|SOL-11.1-010320

STIG-Legacy|SV-60697

STIG-Legacy|V-47821

Vuln-ID|V-219963

SOL-11.1-010320 - The audit system must be configured to audit all discretionary access control permission modifications.

SOL-11.1-010330 - The audit system must be configured to audit the loading and unloading of dynamic kernel modules - getpolicy

Rule-ID|SV-219964r877438_rule

STIG-ID|SOL-11.1-010330

STIG-Legacy|SV-60699

STIG-Legacy|V-47823

Vuln-ID|V-219964

SOL-11.1-010330 - The audit system must be configured to audit the loading and unloading of dynamic kernel modules.

SOL-11.1-010340 - The audit system must be configured to audit failed attempts to access files and programs - getflags ex

Rule-ID|SV-216268r603267_rule

STIG-ID|SOL-11.1-010340

STIG-Legacy|SV-60701

STIG-Legacy|V-47825

Vuln-ID|V-216268

SOL-11.1-010340 - The audit system must be configured to audit failed attempts to access files and programs - getflags fa

SOL-11.1-010340 - The audit system must be configured to audit failed attempts to access files and programs - getflags ps

SOL-11.1-010340 - The audit system must be configured to audit failed attempts to access files and programs - getpolicy

SOL-11.1-010350 - The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server - '.conf'

CCI|CCI-000166

Rule-ID|SV-216269r603267_rule

STIG-ID|SOL-11.1-010350

STIG-Legacy|SV-60703

STIG-Legacy|V-47827

Vuln-ID|V-216269

SOL-11.1-010350 - The operating system must protect against an individual falsely denying having performed a particular action. In order to do so the system must be configured to send audit records to a remote audit server - 'getplugin'

SOL-11.1-010360 - The auditing system must not define a different auditing level for specific users.

Rule-ID|SV-216270r603267_rule

STIG-ID|SOL-11.1-010360

STIG-Legacy|SV-60705

STIG-Legacy|V-47831

Vuln-ID|V-216270

SOL-11.1-010370 - The audit system must alert the SA when the audit storage volume approaches its capacity.

CCI|CCI-001855

Rule-ID|SV-219965r854528_rule

STIG-ID|SOL-11.1-010370

STIG-Legacy|SV-60709

STIG-Legacy|V-47835

Vuln-ID|V-219965

SOL-11.1-010380 - The audit system must alert the System Administrator (SA) if there is any type of audit failure.

Detections

Analytics

DISA STIG Solaris 11 SPARC v2r7

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Oct 17, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Sep 19, 2023 Functional Update SOL-11.1-020310 - All run control scripts must have no extended ACLs - '/etc/init.d/' SOL-11.1-020310 - All run control scripts must have no extended ACLs - '/etc/rc' SOL-11.1-020350 - Run control scripts must not execute world writable programs or scripts. SOL-11.1-020520 - The .Xauthority files must not have extended ACLs. SOL-11.1-070010 - The sticky bit must be set on all world writable directories. SOL-11.1-070180 - World-writable files must not exist. SOL-11.1-070190 - All valid SUID/SGID files must be documented. SOL-11.1-070200 - The operating system must have no unowned files. SOL-11.1-070210 - The operating system must have no files with extended attributes. SOL-11.1-070260 - The operator must document all file system objects that have non-standard access control list settings. Miscellaneous Metadata updated. References updated. Variables updated.
Revision 1.1 May 31, 2023 Miscellaneous Variables updated.