| 1.1.2.6.2 Ensure nosuid option set on /var/audit partition | CIS FreeBSD 14 v1.0.1 L1 | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.7 Audit docker daemon | CIS Docker 1.12.0 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.8 Audit docker daemon | CIS Docker 1.6 v1.0.0 L1 Linux | Unix | AUDIT AND ACCOUNTABILITY |
| 1.37 APPL-14-001013 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 1.37 APPL-26-001013 | CIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 1.38 APPL-14-001014 | CIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 1.101 WN11-AU-000585 | CIS Microsoft Windows 11 STIG v1.2.0 CAT II | Windows | ACCESS CONTROL |
| 1.162 OL09-00-000855 | CIS Oracle Linux 9 STIG v1.0.0 CAT II | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.2 Ensure audit logs are not automatically deleted | CIS Fedora 28 Family Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.2 Ensure audit logs are not automatically deleted | CIS CentOS Linux 8 Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.2 Ensure audit logs are not automatically deleted | CIS SUSE Linux Enterprise 12 v3.2.1 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.2.13 Ensure off-loaded audit logs are labeled. | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.28 Ensure audit unlinkat syscall - 64 bit | CIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS Red Hat Enterprise Linux 7 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS Oracle Linux 7 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS Debian Linux 10 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS Oracle Linux 7 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS CentOS Linux 7 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS CentOS Linux 7 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.2.2 Ensure audit logs are not automatically deleted | CIS Ubuntu Linux 18.04 LTS v2.2.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 5.3.4 Ensure AUDIT_ADMIN' Is Revoked from Unauthorized 'GRANTEE' | CIS Oracle Server 18c DB Traditional Auditing v1.1.0 | OracleDB | ACCESS CONTROL, MEDIA PROTECTION |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Debian Linux 13 v1.1.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS AlmaLinux OS 9 v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Ubuntu Linux 26.04 LTS v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Red Hat Enterprise Linux 9 v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.2.2 Ensure audit logs are not automatically deleted | CIS Oracle Linux 9 v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS Oracle Linux 8 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS Red Hat Enterprise Linux 10 v1.0.1 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS AlmaLinux OS 8 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS AlmaLinux OS 8 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.2.2 Ensure audit logs are not automatically deleted | CIS AlmaLinux OS 10 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.4.2.2 Ensure audit logs are not automatically deleted | CIS Debian Linux 11 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.9 Ensure 'Audit Changes to Audit Policy' is set to include 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.1 (L1) Ensure 'Audit Audit Policy Change' is set to include 'Success' | CIS Windows Server 2012 R2 MS L1 v3.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.1 (L1) Ensure 'Audit Audit Policy Change' is set to include 'Success' | CIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.3.1 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Authentication Policy Change | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Computer Account Management | MSCT Windows Server 2016 DC v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Security Group Management | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit User Account Management | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Big Sur - Configure Audit Log Files to Mode 440 or Less Permissive | NIST macOS Big Sur v1.4.0 - 800-53r4 Low | Unix | AUDIT AND ACCOUNTABILITY |
| Catalina - Configure Audit Log Files to Mode 440 or Less Permissive | NIST macOS Catalina v1.5.0 - 800-53r4 High | Unix | AUDIT AND ACCOUNTABILITY |
| EPAS-00-002300 - The EDB Postgres Advanced Server must, by default, shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure. | EnterpriseDB PostgreSQL Advanced Server OS Linux v2r1 | Unix | AUDIT AND ACCOUNTABILITY |
| Monterey - Configure Audit Log Files to Mode 440 or Less Permissive | NIST macOS Monterey v1.0.0 - 800-53r5 Moderate | Unix | AUDIT AND ACCOUNTABILITY |
| Monterey - Configure Audit Log Files to Mode 440 or Less Permissive | NIST macOS Monterey v1.0.0 - CNSSI 1253 | Unix | AUDIT AND ACCOUNTABILITY |
| PHTN-40-000030 - The Photon operating system must allow only authorized users to configure the auditd service. | DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r3 | Unix | AUDIT AND ACCOUNTABILITY |
| SLEM-05-653050 - SLEM 5 must protect audit rules from unauthorized modification. | DISA SUSE Linux Enterprise Micro SLEM 5 STIG v1r4 | Unix | AUDIT AND ACCOUNTABILITY |
