| 1.7.9 - Miscellaneous Enhancements - AIX Auditing - 'validate /etc/security/audit/config - bin2 = /audit/bin2' | CIS AIX 5.3/6.1 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.7.9 - Miscellaneous Enhancements - AIX Auditing - 'validate /etc/security/audit/config - binmode = on' | CIS AIX 5.3/6.1 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.7.9 - Miscellaneous Enhancements - AIX Auditing - 'validate /etc/security/audit/config - binsize <= 10240' | CIS AIX 5.3/6.1 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.7.9 - Miscellaneous Enhancements - AIX Auditing - 'validate /etc/security/audit/config - streammode = off' | CIS AIX 5.3/6.1 L2 v1.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.8 Ensure login and logout events are collected - '/var/log/faillog' | CIS Ubuntu Linux 14.04 LTS Workstation L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.8 Ensure login and logout events are collected - '/var/log/lastlog' | CIS Ubuntu Linux 14.04 LTS Workstation L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.8 Ensure login and logout events are collected - /var/log/lastlog | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - '/var/log/wtmp' | CIS Ubuntu Linux 14.04 LTS Server L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - 'auditctl btmp' | CIS Ubuntu Linux 14.04 LTS Server L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - 'auditctl utmp' | CIS Ubuntu Linux 14.04 LTS Workstation L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - 'auditctl wtmp' | CIS Ubuntu Linux 14.04 LTS Server L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - 'auditctl wtmp' | CIS Ubuntu Linux 14.04 LTS Workstation L2 v2.1.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - utmp | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.9 Ensure session initiation information is collected - wtmp | CIS Amazon Linux v2.1.0 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.36 init.ora - 'sec_protocol_error_trace_action = LOG or ALERT' | CIS v1.1.0 Oracle 11g OS Windows Level 1 | Windows | AUDIT AND ACCOUNTABILITY |
| 5.1 Turn on inetd tracing, Check if 'ENABLE_CONNECTION_LOGGING' is set to YES in /etc/default/inetd. | CIS Solaris 9 v1.3 | Unix | AUDIT AND ACCOUNTABILITY |
| Audit Account Lockout: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Authorization Policy Change: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Detailed File Share: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Group Membership: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Kerberos Authentication Service: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Kerberos Service Ticket Operations: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Logon: MSFT Windows 11 26H2 - Computer | MSCT Windows 11 v26H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit MPSSVC Rule-Level Policy Change: MSFT Windows Server 2025 v2602 - Member Server | MSCT Windows Server 2025 MS v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Other Logon/Logoff Events: MSFT Windows Server 2025 v2602 - Member Server | MSCT Windows Server 2025 MS v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Other Policy Change Events: MSFT Windows 11 26H2 - Computer | MSCT Windows 11 v26H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Other Policy Change Events: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Process Creation: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Removable Storage: MSFT Windows Server 2025 v2602 - Member Server | MSCT Windows Server 2025 MS v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Security System Extension: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Special Logon: MSFT Windows 11 26H2 - Computer | MSCT Windows 11 v26H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Special Logon: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit System Integrity: MSFT Windows Server 2025 v2602 - Domain Controller | MSCT Windows Server 2025 DC v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit System Integrity: MSFT Windows Server 2025 v2602 - Member Server | MSCT Windows Server 2025 MS v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit User Account Management: MSFT Windows 11 26H2 - Computer | MSCT Windows 11 v26H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit User Account Management: MSFT Windows Server 2025 v2602 - Member Server | MSCT Windows Server 2025 MS v2602 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Ensure login and logout events are collected - auditctl faillog | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure login and logout events are collected - faillog | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure login and logout events are collected - tallylog | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure session initiation information is collected - auditctl utmp | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure session initiation information is collected - auditctl wtmp | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Ensure session initiation information is collected - utmp | Tenable Cisco Firepower Management Center OS Best Practices Audit | Unix | AUDIT AND ACCOUNTABILITY |
| Log dropped packets - Private Profile | MSCT Windows 10 v22H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log dropped packets - Public Profile | MSCT Windows 10 v22H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log dropped packets - Public Profile | MSCT Windows 11 v24H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log dropped packets - Public Profile | MSCT Windows 11 v23H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log successful connections - Private Profile | MSCT Windows 10 v22H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log successful connections - Public Profile | MSCT Windows 11 v22H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log successful connections - Public Profile | MSCT Windows 10 v21H1 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Log successful connections - Public Profile | MSCT Windows 11 v24H2 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
