| 1.1.6 Set 'aaa accounting' to log all privileged use commands using 'commands 15' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | AUDIT AND ACCOUNTABILITY |
| 1.1.10 Set 'aaa accounting system' | CIS Cisco IOS XE 17.x v2.2.1 L1 | Cisco | AUDIT AND ACCOUNTABILITY |
| 1.1.37 Ensure that the AdvancedAuditing argument is not set to false - audit-policy-file | CIS Kubernetes 1.13 Benchmark v1.4.1 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.3.1 Ensure AIDE is installed | CIS Oracle Linux 6 Workstation L1 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.3.1 Ensure AIDE is installed | CIS Red Hat 6 Server L1 v3.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.3.1 Ensure AIDE is installed - aide | CIS Ubuntu Linux 16.04 LTS Server L1 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.3.1 Ensure AIDE is installed - aide-common | CIS Ubuntu Linux 16.04 LTS Server L1 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.3.2 Ensure filesystem integrity is regularly checked | CIS Oracle Linux 6 Server L1 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.4.2 Ensure filesystem integrity is regularly checked | CIS Ubuntu Linux 18.04 LXD Container L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.4.2 Ensure filesystem integrity is regularly checked | CIS Ubuntu Linux 18.04 LXD Host L1 Server v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.5.1 Ensure prelink is disabled | CIS Ubuntu Linux 18.04 LXD Container L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 2.2.1 (L1) Ensure 'Access Credential Manager as a trusted caller' is set to 'No One' | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | AUDIT AND ACCOUNTABILITY |
| 4.1 Ensure CloudTrail is enabled in all regions | CIS Amazon Web Services Foundations v7.0.0 L1 | amazon_aws | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/group | CIS Ubuntu Linux 18.04 LXD Host L2 Server v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/gshadow | CIS Ubuntu Linux 18.04 LXD Host L2 Workstation v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd | CIS Ubuntu Linux 18.04 LXD Host L2 Server v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - /etc/security/opasswd | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - /etc/shadow | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - auditctl /etc/gshadow | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.6 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES | CIS Ubuntu Linux 18.04 LXD Host L2 Workstation v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM | CIS Ubuntu Linux 18.04 LXD Host L2 Server v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.10 Ensure unsuccessful unauthorized file access attempts are collected - EPERM | CIS Ubuntu Linux 18.04 LXD Host L2 Workstation v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.12 Ensure unsuccessful unauthorized file access attempts are collected - auditctl b32 EACCES | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.12 Ensure unsuccessful unauthorized file access attempts are collected - b32 EPERM | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.12 Ensure unsuccessful unauthorized file access attempts are collected - b64 EACCES | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.12 Ensure unsuccessful unauthorized file access attempts are collected - b64 EPERM | CIS Distribution Independent Linux Server L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.14 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers.d | CIS Ubuntu Linux 18.04 LXD Host L2 Server v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.14 Ensure changes to system administration scope (sudoers) is collected - sudoers.d | CIS Ubuntu Linux 18.04 LXD Host L2 Workstation v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.1.16 Ensure changes to system administration scope (sudoers) is collected - auditctl /etc/sudoers.d | CIS Distribution Independent Linux Workstation L2 v2.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.6 Ensure login and logout events are collected | CIS FreeBSD 14 v1.0.1 L2 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3.10 Ensure successful file system mounts are collected | CIS Oracle Linux 7 v4.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.10 Ensure successful file system mounts are collected | CIS Oracle Linux 7 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 5.2.3.12 Ensure login and logout events are collected | CIS Red Hat Enterprise Linux 7 v4.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY |
| 6.1.3 Ensure the 'SYSTEM GRANT' Audit Option Is Enabled | CIS Oracle Server 18c DB Traditional Auditing v1.1.0 | OracleDB | AUDIT AND ACCOUNTABILITY |
| 6.2.3.4 Ensure events that modify date and time information are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.4 Ensure events that modify date and time information are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.5 Ensure events that modify sethostname and setdomainname are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.5 Ensure events that modify the system's network environment are collected | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.6 Ensure events that modify /etc/issue and /etc/issue.net are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.7 Ensure events that modify /etc/hosts and /etc/hostname are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.8 Ensure events that modify /etc/network and /etc/networks are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.9 Ensure events that modify /etc/netplan are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.12 Ensure login and logout events are collected | CIS Ubuntu Linux 22.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY |
| 6.2.3.18 Ensure discretionary access control permission modification events are collected | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.19 Ensure successful file system mounts are collected | CIS Debian Linux 12 v2.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.19 Ensure successful file system mounts are collected | CIS Debian Linux 12 v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.2.3.19 Ensure successful file system mounts are collected | CIS Ubuntu Linux 24.04 LTS v2.0.0 L2 Workstation | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.3.3.9 Ensure discretionary access control permission modification events are collected | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 6.3.3.14 Ensure events that modify the system's Mandatory Access Controls are collected | CIS Ubuntu Linux 20.04 LTS v3.0.0 L2 Server | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
