800-53|AU-12b.

Title

AUDIT GENERATION

Description

Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

Reference Item Details

Category: AUDIT AND ACCOUNTABILITY

Family: AUDIT AND ACCOUNTABILITY

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-002200 - The AIX audit configuration files must be owned by root.UnixDISA STIG AIX 7.x v2r5
AIX7-00-002201 - The AIX audit configuration files must be group-owned by audit.UnixDISA STIG AIX 7.x v2r5
AIX7-00-002202 - The AIX audit configuration files must be set to 640 or less permissive.UnixDISA STIG AIX 7.x v2r5
Big Sur - Only allow authorized users to select auditable eventsUnixNIST macOS Big Sur v1.4.0 - All Profiles
Catalina - Only allow authorized users to select auditable eventsUnixNIST macOS Catalina v1.5.0 - All Profiles
DKER-EE-001090 - The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set - docker pathsUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
DKER-EE-001090 - The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set - docker servicesUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
DKER-EE-001370 - log-opts on all Docker Engine - Enterprise nodes must be configured.UnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data dirWindowsEDB PostgreSQL Advanced Server v11 Windows OS Audit v2r1
EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data\*WindowsEDB PostgreSQL Advanced Server v11 Windows OS Audit v2r1
EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - postgresql.confWindowsEDB PostgreSQL Advanced Server v11 Windows OS Audit v2r1
ESXI-06-100030 - The VMM must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000030 - The ESXi host must produce audit records containing information to establish what type of events occurred.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r2
JBOS-AS-000085 - JBoss must be configured to allow only the ISSM (or individuals or roles appointed by the ISSM) to select which loggable events are to be logged.UnixDISA RedHat JBoss EAP 6.3 STIG v2r3
MD3X-00-000040 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.UnixDISA STIG MongoDB Enterprise Advanced 3.x v2r1 OS
MD4X-00-000100 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.UnixDISA STIG MongoDB Enterprise Advanced 4.x v1r1 OS
Monterey - Only allow authorized users to select auditable eventsUnixNIST macOS Monterey v1.0.0 - All Profiles
OL08-00-030610 - OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - /etc/audit/auditd.confUnixDISA Oracle Linux 8 STIG v1r2
OL08-00-030610 - OL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - /etc/audit/rules.d/*.rulesUnixDISA Oracle Linux 8 STIG v1r2
PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - ConfigUnixDISA STIG PostgreSQL 9.x on RHEL OS v2r2
PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - DataUnixDISA STIG PostgreSQL 9.x on RHEL OS v2r2
PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - RolesUnixDISA STIG PostgreSQL 9.x on RHEL OS v2r2
PHTN-67-000019 - The Photon operating system must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r3
PPS9-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.UnixEDB PostgreSQL Advanced Server OS Linux Audit v2r1
RHEL-08-030610 - RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - /etc/audit/auditd.confUnixDISA Red Hat Enterprise Linux 8 STIG v1r6
RHEL-08-030610 - RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - /etc/audit/rules.d/*.rulesUnixDISA Red Hat Enterprise Linux 8 STIG v1r6
SHPT-00-000315 - SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.WindowsDISA STIG SharePoint 2010 v1r9
SP13-00-000055 - SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system.WindowsDISA STIG SharePoint 2013 v2r3
TCAT-AS-000180 - AccessLogValve must be configured per each virtual host.UnixDISA STIG Apache Tomcat Application Server 9 v2r4 Middleware
TCAT-AS-000180 - AccessLogValve must be configured per each virtual host.UnixDISA STIG Apache Tomcat Application Server 9 v2r4
UBTU-16-020150 - The Ubuntu operating system must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - audit.rulesUnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-16-020150 - The Ubuntu operating system must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - auditd.confUnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-18-010311 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - audit.rulesUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010311 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - auditd.confUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010311 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - rules.d/*UnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010312 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - audit.rulesUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010312 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - auditd.confUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010312 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - rules.d/*UnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010313 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - audit.rulesUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010313 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - auditd.confUnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-18-010313 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - rules.d/*UnixDISA STIG Ubuntu 18.04 LTS v2r7
UBTU-20-010133 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - audit.rulesUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010133 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - auditd.confUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010133 - The Ubuntu operating system must be configured so that audit configuration files are not write-accessible by unauthorized users - rules.d/*UnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010134 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - audit.rulesUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010134 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - auditd.confUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010134 - The Ubuntu operating system must permit only authorized accounts to own the audit configuration files - rules.d/*UnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010135 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - audit.rulesUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010135 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - auditd.confUnixDISA STIG Ubuntu 20.04 LTS v1r4
UBTU-20-010135 - The Ubuntu operating system must permit only authorized groups to own the audit configuration files - rules.d/*UnixDISA STIG Ubuntu 20.04 LTS v1r4