| 2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 5.2.4.1 Ensure audit log files are mode 0640 or less permissive | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.4 Ensure the audit log directory is 0750 or more restrictive | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.5 Ensure audit configuration files are 640 or more restrictive | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.5 Ensure audit configuration files are 640 or more restrictive | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.6 Ensure audit configuration files are owned by root | CIS Ubuntu Linux 18.04 LTS v2.2.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.6 Ensure audit configuration files are owned by root | CIS Ubuntu Linux 18.04 LTS v2.2.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.7 Ensure audit configuration files belong to group root | CIS Ubuntu Linux 18.04 LTS v2.2.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.8 Ensure audit tools are 755 or more restrictive | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.8 Ensure audit tools are 755 or more restrictive | CIS Ubuntu Linux 18.04 LTS v2.2.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.4.10 Ensure audit tools belong to group root | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.1 Ensure audit log files mode is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.1 Ensure audit log files mode is configured | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.2 Ensure audit log files owner is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.2 Ensure audit log files owner is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.2 Ensure audit log files owner is configured | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.3 Ensure audit log files group owner is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.6 Ensure audit configuration files owner is configured | CIS Linux Mint 22 v1.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.7 Ensure audit configuration files group owner is configured | CIS Linux Mint 22 v1.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.7 Ensure audit configuration files group owner is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.7 Ensure audit configuration files group owner is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.9 Ensure audit tools owner is configured | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.9 Ensure audit tools owner is configured | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.4.10 Ensure audit tools group owner is configured | CIS Debian Linux 13 v1.1.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.4.4 Ensure the audit log file directory mode is configured | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.4.6 Ensure audit configuration files owner is configured | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.4.9 Ensure audit tools owner is configured | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.4.9 Ensure audit tools owner is configured | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 17.7.3 Ensure 'Audit Authorization Policy Change' is set to include 'Success' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 17.7.5 Ensure 'Audit Other Policy Change Events' is set to include 'Failure' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| BIND-9X-001060 - The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred. | DISA BIND 9.x STIG v3r3 | Unix | AUDIT AND ACCOUNTABILITY |
| CASA-ND-000260 - The Cisco ASA must be configured to produce audit log records containing sufficient information to establish what type of event occurred. | DISA STIG Cisco ASA NDM v2r5 | Cisco | AUDIT AND ACCOUNTABILITY |
| CASA-ND-000280 - The Cisco ASA must be configured to produce audit records containing information to establish where the events occurred. | DISA STIG Cisco ASA NDM v2r5 | Cisco | AUDIT AND ACCOUNTABILITY |
| CD16-00-001100 - PostgreSQL must produce audit records containing time stamps to establish when the events occurred. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD16-00-001200 - PostgreSQL must produce audit records containing sufficient information to establish where the events occurred. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| CD16-00-001500 - PostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event. | DISA Crunchy Data Postgres 16 STIG v1r3 PostgreSQLDB | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| EPAS-00-002000 - The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events. | EnterpriseDB PostgreSQL Advanced Server DB v2r1 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| EPAS-00-002100 - The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event. | EnterpriseDB PostgreSQL Advanced Server DB v2r1 | PostgreSQLDB | AUDIT AND ACCOUNTABILITY |
| EX19-MB-000041 - Exchange message tracking logging must be enabled. | DISA Microsoft Exchange 2019 Mailbox Server STIG v2r3 | Windows | AUDIT AND ACCOUNTABILITY |
| JUEX-RT-000240 - The Juniper router must be configured to produce audit records containing information to establish where the events occurred. | DISA Juniper EX Series Switches Router STIG v2r1 | Juniper | AUDIT AND ACCOUNTABILITY |
| RHEL-10-500120 - RHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event. | DISA Red Hat Enterprise Linux 10 STIG v1r2 | Unix | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 105' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 111' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 113' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 132' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 134' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011800 - SQL Server must produce audit records containing sufficient information to establish what type of events occurred - 'Event ID 135' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011900 - SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred - 'Event ID 106' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011900 - SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred - 'Event ID 109' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
| SQL2-00-011900 - SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred - 'Event ID 113' | DISA STIG SQL Server 2012 DB Instance Security v1r20 | MS_SQLDB | AUDIT AND ACCOUNTABILITY |
