Item Search

Name	Audit Name	Plugin	Category
Audit SGID executables	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Audit SUID executables	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure access to the su command is restricted - pam_wheel.so	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure access to the su command is restricted - wheel group contains root	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure address space layout randomization (ASLR) is enabled - sysctl.conf	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND INFORMATION INTEGRITY
Ensure AIDE is installed - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure at/cron is restricted to authorized users - at.deny	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure at/cron is restricted to authorized users - cron.deny	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure bogus ICMP responses are ignored - /etc/sysctl	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure bogus ICMP responses are ignored - sysctl	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure broadcast ICMP requests are ignored - /etc/sysctl	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure changes to system administration scope (sudoers) is collected - auditctl /etc/sudoers.d	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure core dumps are restricted - limits.conf	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure core dumps are restricted - sysctl	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure CUPS Server is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure daytime services are not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure default deny firewall policy - Chain INPUT	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure DHCP Server is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure discretionary access control permission modification events are collected - auditctl b32 chmod fchmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure discretionary access control permission modification events are collected - auditctl b32 chown fchown	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure discretionary access control permission modification events are collected - auditctl b64 chmod fchmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - audit.rules b32 clock_settime	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - audit.rules time-change	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - auditctl b32 adjtimex	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - auditctl b32 clock_settime	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - auditctl time-change	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - /etc/hosts	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - /etc/sysconfig/network	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - auditctl b32 sethostname	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure GDM login banner is configured - user-db	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure GPG keys are configured - apt-key list	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND INFORMATION INTEGRITY
Ensure ICMP redirects are not accepted - sysctl ipv4 all accept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure NFS and RPC are not enabled - NFS	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure NFS and RPC are not enabled - RPC	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure NIS Server is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure Reverse Path Filtering is enabled - /etc/sysctl ipv4 all rp_filter	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure Samba is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure SSH HostbasedAuthentication is disabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION
Ensure SSH X11 forwarding is disabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure talk client is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure talk server is not enabled - ntalk	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure telnet client is not installed - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure telnet client is not installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure TIPC is disabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure unsuccessful unauthorized file access attempts are collected - b32 EACCES	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Lockout for failed password attempts - 'auth sufficient pam_unix.so'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Lockout for failed password attempts - password-auth 'auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL

Detections

Analytics

Item Search