| 3.500 - The system must audit all uses of the creat syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.500 - The system must audit all uses of the creat syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.500 - The system must audit all uses of the creat syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.500 - The system must audit all uses of the creat syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.510 - The system must audit all uses of the open syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.510 - The system must audit all uses of the open syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.510 - The system must audit all uses of the open syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.510 - The system must audit all uses of the open syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.520 - The system must audit all uses of the openat syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.520 - The system must audit all uses of the openat syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.520 - The system must audit all uses of the openat syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.520 - The system must audit all uses of the openat syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.530 - The system must audit all uses of the open_by_handle_at syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.530 - The system must audit all uses of the open_by_handle_at syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.530 - The system must audit all uses of the open_by_handle_at syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.530 - The system must audit all uses of the open_by_handle_at syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.540 - The system must audit all uses of the truncate syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.540 - The system must audit all uses of the truncate syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.540 - The system must audit all uses of the truncate syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.540 - The system must audit all uses of the truncate syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.550 - The system must audit all uses of the ftruncate syscall - EACCES 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.550 - The system must audit all uses of the ftruncate syscall - EACCES 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.550 - The system must audit all uses of the ftruncate syscall - EPERM 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.550 - The system must audit all uses of the ftruncate syscall - EPERM 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.590 - The system must audit all uses of the setfiles command. | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.740 - The system must audit all uses of the mount command and syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.740 - The system must audit all uses of the mount command and syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.740 - The system must audit all uses of the mount command and syscall. | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.880 - The system must audit all uses of the rename syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.880 - The system must audit all uses of the rename syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.890 - The system must audit all uses of the renameat syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.890 - The system must audit all uses of the renameat syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.900 - The system must audit all uses of the rmdir syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.900 - The system must audit all uses of the rmdir syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.910 - The system must audit all uses of the unlink syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.910 - The system must audit all uses of the unlink syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.920 - The system must audit all uses of the unlinkat syscall - 32 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.920 - The system must audit all uses of the unlinkat syscall - 64 bit | Tenable Fedora Linux Best Practices v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - gid 32 | DISA STIG VMware vSphere 6.7 Photon OS v1r3 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - gid 64 | DISA STIG VMware vSphere 6.7 Photon OS v1r1 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - gid 64 | DISA STIG VMware vSphere 6.7 Photon OS v1r5 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - uid 32 | DISA STIG VMware vSphere 6.7 Photon OS v1r3 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - uid 32 | DISA STIG VMware vSphere 6.7 Photon OS v1r1 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - uid 32 | DISA STIG VMware vSphere 6.7 Photon OS v1r5 | Unix | |
| PHTN-67-000012 - The Photon operating system must be configured to audit the execution of privileged functions - uid 64 | DISA STIG VMware vSphere 6.7 Photon OS v1r5 | Unix | |
| RHEL-09-654250 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. | DISA Red Hat Enterprise Linux 9 STIG v1r2 | Unix | |
| RHEL-09-654250 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock. | DISA Red Hat Enterprise Linux 9 STIG v1r1 | Unix | |
| RHEL-09-654260 - RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/tallylog. | DISA Red Hat Enterprise Linux 9 STIG v1r2 | Unix | |
| UBTU-20-010244 - The Ubuntu operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. | DISA STIG Ubuntu 20.04 LTS v1r9 | Unix | |
| UBTU-20-010244 - The Ubuntu operating system must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access. | DISA STIG Ubuntu 20.04 LTS v1r4 | Unix | |
