Item Search

Name	Audit Name	Plugin	Category
Ensure events that modify the system's network environment are collected - auditctl /etc/issue.net	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - /etc/security/opasswd	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure iptables is installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure iptables is installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure kernel module loading and unloading is collected - auditctl modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure kernel module loading and unloading is collected - auditctl rmmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure kernel module loading and unloading is collected - insmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure kernel module loading and unloading is collected - rmmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure login and logout events are collected - auditctl lastlog	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure mounting of cramfs filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of freevxfs filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of jffs2 filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of jffs2 filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of squashfs filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure mounting of udf filesystems is disabled - lsmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure no unconfined daemons exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure nodev option set on /dev/shm partition	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure ntp is configured - OPTIONS or ExecStart -u ntp:ntp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure packet redirect sending is disabled - /etc/sysctl ipv4 default send	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure password creation requirements are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - /etc/pam.d/* try_first_pass	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - pwquality.conf lcredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password reuse is limited - pam_pwhistory.so	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/cron.d are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/gshadow- are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/passwd- are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure prelink is disabled - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure remote rsyslog messages are only accepted on designated log hosts - InputTCPServerRun	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure remote rsyslog messages are only accepted on designated log hosts - ModLoad	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure remote syslog-ng messages are only accepted on designated log hosts	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure rsh server is not enabled - rexec	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure rsyslog default file permissions configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure rsyslog Service is enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure separate partition exists for /var/log/audit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
Ensure session initiation information is collected - auditctl btmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure source routed packets are not accepted - /etc/sysctl ipv4 all acccept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure source routed packets are not accepted - sysctl ipv4 default accept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure sticky bit is set on all world-writable directories	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure successful file system mounts are collected - b64	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure syslog-ng is configured to send logs to a remote log host	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure system accounts are non-login	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure talk client is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure telnet server is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure unsuccessful unauthorized file access attempts are collected - b32 EPERM	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure updates, patches, and additional security software are installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND INFORMATION INTEGRITY
Ensure users' dot files are not group or world writable	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure users' home directories permissions are 750 or more restrictive	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure xinetd is not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Lockout for failed password attempts - 'auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL

Detections

Analytics

Item Search