Detections
Analytics

CSCv6|6

Title

Maintenance, Monitoring, and Analysis of Audit Logs

Description

Maintenance, Monitoring, and Analysis of Audit Logs

Reference Item Details

Category: Maintenance, Monitoring, and Analysis of Audit Logs

Family: System

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.2.12 Set 'Audit Policy: System: Security System Extension' to 'Success and Failure'WindowsCIS Windows 8 L1 v1.0.0
1.1.2.34 Set 'Audit Policy: System: System Integrity' to 'Success and Failure'WindowsCIS Windows 8 L1 v1.0.0
1.1.3.2.1 Set 'Audit: Shut down system immediately if unable to log security audits' to 'Disabled'WindowsCIS Windows 8 L1 v1.0.0
1.1.9 Set 'aaa accounting exec'CiscoCIS Cisco IOS 15 L2 v4.0.1
1.1.9 Set 'aaa accounting exec'CiscoCIS Cisco IOS 15 L2 v4.1.0
1.1.9 Set 'aaa accounting exec'CiscoCIS Cisco IOS 16 L2 v1.1.2
1.1.10 Set 'aaa accounting exec'CiscoCIS Cisco IOS 16 L2 v1.1.0
1.1.10 Set 'aaa accounting exec'CiscoCIS Cisco IOS 16 L2 v1.1.1
1.1.11 Set 'aaa accounting system'CiscoCIS Cisco IOS 15 L2 v4.1.0
1.1.11 Set 'aaa accounting system'CiscoCIS Cisco IOS 16 L2 v1.1.2
1.1.11 Set 'aaa accounting system'CiscoCIS Cisco IOS 15 L2 v4.0.1
1.1.12 Set 'aaa accounting system'CiscoCIS Cisco IOS 16 L2 v1.1.1
1.1.12 Set 'aaa accounting system'CiscoCIS Cisco IOS 16 L2 v1.1.0
1.5.8 Ensure that the --max-wals argument is set to 0UnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.5.8 Ensure that the --max-wals argument is set to 0UnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.15 Ensure 'Use network-provided time' and 'Use network-provided time zone' are set to 'Enabled'MDMAirWatch - CIS Google Android v1.3.0 L1
1.15 Ensure 'Use network-provided time' and 'Use network-provided time zone' are set to 'Enabled'MDMMobileIron - CIS Google Android v1.3.0 L1
1.15 Ensure 'Automatic date & time' and 'Automatic time zone' are set to EnabledMDMAirWatch - CIS Google Android v1.2.0 L1
1.15 Ensure 'Automatic date & time' and 'Automatic time zone' are set to EnabledMDMMobileIron - CIS Google Android v1.2.0 L1
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows 10 Enterprise (Release 1607) v1.2.0 Level 1 Bitlocker
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.0 L1 Bitlocker
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 1803) v1.5.0 Level 1
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.0 L1
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Windows Server 2012 DC L1 v2.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2008 Domain Controller Level 1 v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2008 R2 Domain Controller Level 1 v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Windows Server 2012 MS L1 v2.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Windows 7 Workstation Level 1 v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 L1 Bitlocker v2.3.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 L1 v2.3.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2008 Member Server Level 1 v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to 'Success and Failure'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.1.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 11 Enterprise v1.0.0 L1 + BL
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 11 Enterprise v1.0.0 L1 + NG
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 11 Enterprise v1.0.0 L1
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows Server 2008 R2 Member Server Level 1 v3.2.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 1809) v1.6.1 L1
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 1903) v1.7.1 L1
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows Server 2012 R2 MS L1 v2.4.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows Server 2016 MS L1 v1.3.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows Server 2012 MS L1 v2.2.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 2004) v1.9.1 L1 + BL
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 21H1) v1.11.0 L1 + NG
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 1809) v1.6.1 L1 + NG
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 20H2) v1.10.1 L1 + BL + NG
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 10 Enterprise (Release 1909) v1.8.1 L1 + BL + NG
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows Server 2012 DC L1 v2.2.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows Server 2012 R2 DC L1 v2.4.0