| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES (64-bit) | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM (64-bit) | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit) | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.11 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit) | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.10 Ensure unsuccessful file access attempts are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.11 Ensure events that modify /etc/group information are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.11 Ensure events that modify /etc/group information are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.11 Ensure events that modify /etc/group information are collected | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.11 Ensure events that modify /etc/group information are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.12 Ensure events that modify /etc/passwd information are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.12 Ensure events that modify /etc/passwd information are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.12 Ensure events that modify /etc/passwd information are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.12 Ensure events that modify /etc/passwd information are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.12 Ensure events that modify /etc/passwd information are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.13 Ensure file deletion events by users are collected | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.3.13 Ensure file deletion events by users are collected | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 6.2.3.14 Ensure events that modify /etc/security/opasswd are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.14 Ensure events that modify /etc/security/opasswd are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.14 Ensure events that modify /etc/security/opasswd are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.14 Ensure events that modify /etc/security/opasswd are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.14 Ensure events that modify /etc/security/opasswd are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.19 Ensure kernel module loading unloading and modification is collected | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.22 Ensure unlink file deletion events by users are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.22 Ensure unlink file deletion events by users are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.23 Ensure rename file deletion events by users are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.23 Ensure rename file deletion events by users are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.30 Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.31 Ensure kernel "delete_module" loading unloading and modification is collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Ubuntu Linux 26.04 LTS v1.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS AlmaLinux OS 9 v3.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Oracle Linux 9 v3.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Rocky Linux 9 v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.35 Ensure the audit configuration is immutable | CIS Oracle Linux 9 v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.1.5 Ensure the operating system allocates a sufficient audit_backlog_limit to capture processes that start prior to the audit daemon | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.12 Ensure login and logout events are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.12 Ensure login and logout events are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.12 Ensure login and logout events are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.21 Ensure the audit configuration is immutable | CIS Rocky Linux 8 v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.21 Ensure the audit configuration is immutable | CIS AlmaLinux OS 8 v4.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.21 Ensure the audit configuration is immutable | CIS Oracle Linux 8 v4.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.36 Ensure the audit configuration is immutable | CIS Red Hat Enterprise Linux 10 v1.0.1 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.36 Ensure the audit configuration is immutable | CIS Oracle Linux 10 v1.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.36 Ensure the audit configuration is immutable | CIS Oracle Linux 10 v1.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.36 Ensure the audit configuration is immutable | CIS Red Hat Enterprise Linux 10 v1.0.1 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.36 Ensure the audit configuration is immutable | CIS AlmaLinux OS 10 v1.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
