Item Search

Name	Audit Name	Plugin	Category
Ensure discretionary access control permission modification events are collected - b32 chown fchown	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure echo services are not enabled	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure events that modify date and time information are collected - audit.rules b64 clock_settime	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify date and time information are collected - auditctl b64 adjtimex	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify the system's network environment are collected - auditctl /etc/hosts	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - /etc/gshadow	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure events that modify user/group information are collected - /etc/shadow	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure kernel module loading and unloading is collected - insmod	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure login and logout events are collected - faillog	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure loopback traffic is configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure mounting of hfs filesystems is disabled - modprobe	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure no duplicate GIDs exist	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure no users have .rhosts files	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure nodev option set on /tmp partition	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Ensure nodev option set on removable media partitions	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure ntp is configured - server	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure packet redirect sending is disabled - sysctl ipv4 all send	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure password creation requirements are configured - /etc/pam.d/* dcredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - /etc/pam.d/* minlen	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - pwquality.conf lcredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - pwquality.conf minlen	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password creation requirements are configured - pwquality.conf ocredit	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure password expiration is 365 days or less	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	IDENTIFICATION AND AUTHENTICATION
Ensure permissions on /etc/cron.hourly are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/crontab are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure permissions on /etc/passwd- are configured	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure root PATH Integrity	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure rsh server is not enabled - rexec	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure rsh server is not enabled - rlogin	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure rsh server is not enabled - rsh	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure secure ICMP redirects are not accepted - /etc/sysctl ipv4 all secure	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure separate partition exists for /var	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure session initiation information is collected - auditctl btmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure session initiation information is collected - btmp	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure source routed packets are not accepted - /etc/sysctl ipv4 all acccept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure source routed packets are not accepted - sysctl ipv4 all acccept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure source routed packets are not accepted - sysctl ipv4 default accept	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	SYSTEM AND COMMUNICATIONS PROTECTION
Ensure successful file system mounts are collected - auditctl b64	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure suspicious packets are logged - /etc/sysctl ipv4 default log_martians	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure suspicious packets are logged - sysctl ipv4 all log_martians	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure talk client is not installed - dpkg	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure talk server is not enabled - ntalk	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure telnet client is not installed - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure telnet client is not installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - rpm	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure the MCS Translation Service (mcstrans) is not installed - zypper	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	CONFIGURATION MANAGEMENT
Ensure unsuccessful unauthorized file access attempts are collected - b32 EACCES	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	AUDIT AND ACCOUNTABILITY
Lockout for failed password attempts - 'auth sufficient pam_unix.so'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL
Lockout for failed password attempts - password-auth 'auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900'	Tenable Cisco Firepower Management Center OS Best Practices Audit	Unix	ACCESS CONTROL

Detections

Analytics

Item Search