| 2.4 Ensure that 'Include/Exclude Networks' is used if User-ID is enabled | CIS Palo Alto Firewall 8 Benchmark L1 v1.0.0 | Palo_Alto | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 2.5.3 Ensure the operating system enables Linux audit logging of the USBGuard daemon | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.7 Ensure kernel module loading and unloading is collected | CIS Amazon Linux 2 STIG v2.0.1 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.3.20 Ensure audit the umount command | CIS Amazon Linux 2 STIG v2.0.1 STIG | Unix | AUDIT AND ACCOUNTABILITY, MAINTENANCE |
| 4.1.3.20 Ensure the audit configuration is immutable | CIS Fedora 28 Family Linux Workstation L2 v2.0.0 | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.1.1.7 Ensure journald default file permissions configured | CIS Debian Linux 10 v2.0.0 L1 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.1.1.7 Ensure journald default file permissions configured | CIS Debian Linux 10 v2.0.0 L1 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.1.1.7 Ensure journald default file permissions configured | CIS Ubuntu Linux 18.04 LTS v2.2.0 L1 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 5.2.3.20 Ensure the audit configuration is immutable | CIS Red Hat Enterprise Linux 7 v4.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.3.20 Ensure the audit configuration is immutable | CIS Debian Linux 10 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 5.2.3.20 Ensure the audit configuration is immutable | CIS CentOS Linux 7 v4.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.1.2 Ensure auditd service is enabled and active | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.1.2 Ensure auditd service is enabled and active | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.25 Ensure successful and unsuccessful attempts to use the chcon command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.25 Ensure successful and unsuccessful attempts to use the chcon command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.26 Ensure successful and unsuccessful attempts to use the setfacl command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.26 Ensure successful and unsuccessful attempts to use the setfacl command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.27 Ensure successful and unsuccessful attempts to use the chacl command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.27 Ensure successful and unsuccessful attempts to use the chcon command are collected | CIS Debian Linux 13 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.28 Ensure successful and unsuccessful attempts to use the usermod command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.28 Ensure successful and unsuccessful attempts to use the usermod command are collected | CIS SUSE Linux Enterprise 16 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.29 Ensure successful and unsuccessful attempts to use the chacl command are collected | CIS Debian Linux 13 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.29 Ensure successful and unsuccessful attempts to use the chacl command are collected | CIS Debian Linux 13 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY |
| 6.2.3.29 Ensure the audit configuration is immutable | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.29 Ensure the audit configuration is immutable | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.2.3.30 Ensure successful and unsuccessful attempts to use the usermod command are collected | CIS Debian Linux 13 v1.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.30 Ensure successful and unsuccessful attempts to use the usermod command are collected | CIS Debian Linux 13 v1.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.1.6 Ensure the operating system's audit daemon is configured to include local events | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.3.3.13 Ensure file deletion events by users are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.13 Ensure file deletion events by users are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.13 Ensure file deletion events by users are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.20 Ensure the audit configuration is immutable | CIS Oracle Linux 9 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.20 Ensure the audit configuration is immutable | CIS Rocky Linux 9 v2.0.0 L2 Server | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.20 Ensure the audit configuration is immutable | CIS AlmaLinux OS 9 v2.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.20 Ensure the audit configuration is immutable | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Workstation | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 6.3.3.25 Ensure successful and unsuccessful attempts to use the crontab command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.29 Ensure successful and unsuccessful attempts to use the ssh-keysign command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.30 Ensure successful and unsuccessful attempts to use the unix_chkpwd command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.32 Ensure successful and unsuccessful attempts to use the userhelper command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.33 Ensure successful and unsuccessful attempts to use the setfiles command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.34 Ensure successful and unsuccessful attempts to use the semanage command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.35 Ensure successful and unsuccessful attempts to use the postqueue command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.36 Ensure successful and unsuccessful attempts to use the postdrop command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.38 Ensure successful and unsuccessful attempts to use the umount command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.39 Ensure successful and unsuccessful attempts to use the mount command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.40 Ensure successful and unsuccessful attempts to use the ssh-agent command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.41 Ensure successful and unsuccessful attempts to use the passwd command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.42 Ensure successful and unsuccessful attempts to use the chage command are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.43 Ensure the audit system prevents unauthorized changes to logon UIDs | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
| 6.3.3.44 Ensure successful and unsuccessful modifications to the faillock file are collected | CIS Red Hat Enterprise Linux 8 STIG v2.0.0 STIG | Unix | AUDIT AND ACCOUNTABILITY |
