CCI|CCI-001464

Title

The information system initiates session audits at system start-up.

Reference Item Details

Category: 2009

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-002023 - AIX must start audit at boot.UnixDISA STIG AIX 7.x v2r9
AOSX-15-001003 - The macOS system must initiate session audits at system startupUnixDISA STIG Apple Mac OSX 10.15 v1r10
APPL-13-001003 - The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.UnixDISA STIG Apple macOS 13 v1r3
AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events - log_config_moduleUnixDISA STIG Apache Server 2.4 Unix Server v2r6
AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events - log_config_moduleUnixDISA STIG Apache Server 2.4 Unix Server v2r6 Middleware
AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events - LogFormatUnixDISA STIG Apache Server 2.4 Unix Server v2r6 Middleware
AS24-U1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events - LogFormatUnixDISA STIG Apache Server 2.4 Unix Server v2r6
AS24-W1-000070 - The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.WindowsDISA STIG Apache Server 2.4 Windows Server v2r3
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 High
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Low
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-171
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - CNSSI 1253
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r4 High
Big Sur - Enable Security AuditingUnixNIST macOS Big Sur v1.4.0 - 800-53r5 Low
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - CNSSI 1253
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r5 Moderate
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r4 High
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r5 Low
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r4 Moderate
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-171
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - All Profiles
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r4 Low
Catalina - Enable Security AuditingUnixNIST macOS Catalina v1.5.0 - 800-53r5 High
CNTR-K8-000610 - The Kubernetes API Server must have an audit log path set.UnixDISA STIG Kubernetes v1r11
DB2X-00-001000 - DB2 must initiate session auditing upon startup - AUDITIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - CHECKINGIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - CONTEXTIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - EXECUTEIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - OBJMAINTIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - Review user policiesIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - SECMAINTIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - SYSADMINIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DB2X-00-001000 - DB2 must initiate session auditing upon startup - VALIDATEIBM_DB2DBDISA STIG IBM DB2 v10.5 LUW v2r1 Database
DKER-EE-001080 - The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.UnixDISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r1
DKER-EE-001090 - The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set - docker pathsUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
DKER-EE-001090 - The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set - docker servicesUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
EP11-00-001400 - The EDB Postgres Advanced Server must initiate support of session auditing upon startup - edb_auditPostgreSQLDBEDB PostgreSQL Advanced Server v11 DB Audit v2r2
EP11-00-001400 - The EDB Postgres Advanced Server must initiate support of session auditing upon startup - edb_audit_statementPostgreSQLDBEDB PostgreSQL Advanced Server v11 DB Audit v2r2
IIST-SI-000206 - Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.WindowsDISA IIS 10.0 Site v2r9
IIST-SV-000102 - The enhanced logging for the IIS 10.0 web server must be enabled and capture all user and web server events.WindowsDISA IIS 10.0 Server v2r10
IIST-SV-000103 - Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled.WindowsDISA IIS 10.0 Server v2r10
IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user sessionWindowsDISA IIS 8.5 Site v2r9
IISW-SI-000206 - Both the log file and Event Tracing for Windows (ETW) for each IIS 8.5 website must be enabled.WindowsDISA IIS 8.5 Site v2r9
IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events.WindowsDISA IIS 8.5 Server v2r7
IISW-SV-000103 - Both the log file and Event Tracing for Windows (ETW) for the IIS 8.5 web server must be enabled.WindowsDISA IIS 8.5 Server v2r7
JBOS-AS-000095 - JBoss must be configured to initiate session logging upon startup.UnixDISA RedHat JBoss EAP 6.3 STIG v2r3
MADB-10-000900 - MariaDB must initiate session auditing upon startup.MySQLDBDISA MariaDB Enterprise 10.x v1r2 DB