1.2.8 Audit process tracking

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

When this option is enabled, an event is generated each time an application or a user starts, stops, or otherwise changes a process.

Solution

Make sure 'Audit process tracking' is set to your organization's security policy.

See Also

https://workbench.cisecurity.org/files/10

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CCE|CCE-1895-2, CCE|CCE-2295-4

Plugin: Windows

Control ID: 5fcf89aad3862394ff96480fb6bbdd74ec4b70e175c3c56d89f234432ec4aa6d