Item Search

Name	Audit Name	Plugin	Category
Ensure authentication required for single user mode	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure changes to system administration scope (sudoers) is collected - /etc/sudoers	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure core dumps are restricted - sysctl.conf	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL, CONFIGURATION MANAGEMENT
Ensure discretionary access control permission modification events are collected - auditctl b64 setxattr	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure discretionary access control permission modification events are collected - b64 chown fchown	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - auditctl /etc/issue	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - auditctl /etc/issue.net	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - auditctl b64 sethostname	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - auditctl /etc/shadow	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure file deletion events by users are collected - auditctl b64 unlink	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure kernel module loading and unloading is collected - rmmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure local login warning banner is configured properly	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of FAT filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of udf filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of udf filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure no duplicate user names exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure no legacy '+' entries exist in /etc/passwd	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure no legacy '+' entries exist in /etc/shadow	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure nodev option set on /home partition	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure noexec option set on /dev/shm partition	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure noexec option set on removable media partitions	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure ntp is configured - restrict -4	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure package manager repositories are configured - apt-cache policy	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND INFORMATION INTEGRITY
Ensure password creation requirements are configured - pwquality.conf dcredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - pwquality.conf ucredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password fields are not empty	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password hashing algorithm is SHA-512	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/cron.weekly are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/group are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure prelink is disabled - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure RDS is disabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure root login is restricted to system console	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure rsync service is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure SSH Idle Timeout Interval is configured - ClientAliveCountMax	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure SSH IgnoreRhosts is enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION
Ensure SSH LoginGraceTime is set to one minute or less	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure SSH PermitEmptyPasswords is disabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure successful file system mounts are collected - b32	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure syslog-ng is configured to send logs to a remote log host	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure system is disabled when audit logs are full - 'space_left_action = email'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure talk server is not enabled - talk	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure TCP Wrappers is installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure telnet server is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure unsuccessful unauthorized file access attempts are collected - auditctl b32 EPERM	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure users own their home directories	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure users' .netrc Files are not group or world accessible	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure users' dot files are not group or world writable	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Lockout for failed password attempts - 'auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL

Detections

Analytics

Item Search