800-53|AC-2(4)

Title

AUTOMATED AUDIT ACTIONS

Description

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].

Reference Item Details

Related: AU-12,AU-2

Category: ACCESS CONTROL

Parent Title: ACCOUNT MANAGEMENT

Family: ACCESS CONTROL

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
4.1.3.14 Ensure events that modify user/group information are collected - groupUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.14 Ensure events that modify user/group information are collected - gshadowUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.14 Ensure events that modify user/group information are collected - opasswdUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.14 Ensure events that modify user/group information are collected - passwdUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
4.1.3.14 Ensure events that modify user/group information are collected - shadowUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/groupUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/audit/configUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/environUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/groupUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/limitsUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/login.cfgUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/passwd readUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/passwd writeUnixDISA STIG AIX 7.x v2r5
AIX7-00-002016 - AIX must provide audit record generation functionality for DoD-defined auditable events - /etc/security/userUnixDISA STIG AIX 7.x v2r5
AMLS-NM-000120 - The Arista Multilayer Switch must automatically audit account creation.AristaDISA STIG Arista MLS DCS-7000 Series NDM v1r3
AMLS-NM-000130 - The Arista Multilayer Switch must automatically audit account modification.AristaDISA STIG Arista MLS DCS-7000 Series NDM v1r3
AMLS-NM-000140 - The Arista Multilayer Switch must automatically audit account disabling actions.AristaDISA STIG Arista MLS DCS-7000 Series NDM v1r3
AMLS-NM-000150 - The Arista Multilayer Switch must automatically audit account removal actions.AristaDISA STIG Arista MLS DCS-7000 Series NDM v1r3
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Low
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Low
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-171
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure System to Audit All Administrative Action EventsUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Configure the System to Notify upon Account Created ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure the System to Notify upon Account Created ActionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure the System to Notify upon Account Created ActionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Notify upon Account Created ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Notify upon Account Disabled ActionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure the System to Notify upon Account Disabled ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure the System to Notify upon Account Disabled ActionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Notify upon Account Disabled ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Notify upon Account Enabled ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Notify upon Account Enabled ActionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure the System to Notify upon Account Enabled ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure the System to Notify upon Account Enabled ActionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Notify upon Account Modified ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Notify upon Account Modified ActionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Configure the System to Notify upon Account Modified ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure the System to Notify upon Account Modified ActionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Notify upon Account Removed ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Configure the System to Notify upon Account Removed ActionsUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Configure the System to Notify upon Account Removed ActionsUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Configure the System to Notify upon Account Removed ActionsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Low
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate