Detections
Analytics

CSCv6|6

Title

Maintenance, Monitoring, and Analysis of Audit Logs

Description

Maintenance, Monitoring, and Analysis of Audit Logs

Reference Item Details

Category: Maintenance, Monitoring, and Analysis of Audit Logs

Family: System

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.2.12 Set 'Audit Policy: System: Security System Extension' to 'Success and Failure'WindowsCIS Windows 8 L1 v1.0.0
1.1.2.34 Set 'Audit Policy: System: System Integrity' to 'Success and Failure'WindowsCIS Windows 8 L1 v1.0.0
1.1.3.2.1 Set 'Audit: Shut down system immediately if unable to log security audits' to 'Disabled'WindowsCIS Windows 8 L1 v1.0.0
1.5.8 Ensure that the --max-wals argument is set to 0UnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.5.8 Ensure that the --max-wals argument is set to 0UnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.15 Ensure 'Use network-provided time' and 'Use network-provided time zone' are set to 'Enabled'MDMMobileIron - CIS Google Android v1.3.0 L1
1.15 Ensure 'Use network-provided time' and 'Use network-provided time zone' are set to 'Enabled'MDMAirWatch - CIS Google Android v1.3.0 L1
2.1.9 Ensure that the --event-qps argument is set to 0UnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
2.1.10 Ensure that the --event-qps argument is set to 0UnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
2.1.11 Ensure that the --event-qps argument is set to 0UnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
2.1.11 Ensure that the --event-qps argument is set to 0UnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
2.2.2 Ensure 'AUDIT_TRAIL' Is Set to 'DB', 'XML', 'OS', 'DB,EXTENDED', or 'XML,EXTENDED'OracleDBCIS Oracle Server 12c DB Traditional Auditing v3.0.0
2.2.2 Ensure 'AUDIT_TRAIL' Is Set to 'DB', 'XML', 'OS', 'DB,EXTENDED', or 'XML,EXTENDED'OracleDBCIS Oracle Server 18c DB Traditional Auditing v1.1.0
2.3.2.2 (L1) Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
2.3.2.2 Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
2.3.2.2 Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
3.1.1 Ensure 'Controls when the profile can be removed' is set to 'Never'MDMMobileIron - CIS Apple iOS 13 and iPadOS 13 Institution Owned L1
3.1.1 Ensure 'Controls when the profile can be removed' is set to 'Never'MDMAirWatch - CIS Apple iOS 13 and iPadOS 13 Institution Owned L1
3.1.10 Ensure the correct syslog facility is selectedPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.10 Ensure the correct syslog facility is selectedPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.10 Ensure the correct syslog facility is selectedPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.10 Ensure the correct syslog facility is selectedPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.11 Ensure the program name for PostgreSQL syslog messages is correctPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.11 Ensure the program name for PostgreSQL syslog messages is correctPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.11 Ensure the program name for PostgreSQL syslog messages is correctPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.11 Ensure the program name for PostgreSQL syslog messages is correctPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.12 Ensure the correct messages are sent to the database clientPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.12 Ensure the correct messages are written to the server logPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.12 Ensure the correct messages are written to the server logPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.12 Ensure the correct messages are written to the server logPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.13 Ensure the correct messages are written to the server logPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.13 Ensure the correct SQL statements generating errors are recordedPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.13 Ensure the correct SQL statements generating errors are recordedPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.13 Ensure the correct SQL statements generating errors are recordedPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.14 Ensure 'debug_print_parse' is disabledPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.14 Ensure 'debug_print_parse' is disabledPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.14 Ensure 'debug_print_parse' is disabledPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.14 Ensure the correct SQL statements generating errors are recordedPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.15 Ensure 'debug_print_rewritten' is disabledPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
3.1.15 Ensure 'debug_print_rewritten' is disabledPostgreSQLDBCIS PostgreSQL 10 DB v1.0.0
3.1.15 Ensure 'debug_print_rewritten' is disabledPostgreSQLDBCIS PostgreSQL 9.6 DB v1.0.0
3.1.15 Ensure 'log_min_duration_statement' is disabledPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.16 Ensure 'debug_print_parse' is disabledPostgreSQLDBCIS PostgreSQL 9.5 DB v1.1.0
3.1.16 Ensure 'debug_print_plan' is disabledPostgreSQLDBCIS PostgreSQL 11 DB v1.0.0
17.9.4 (L1) Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
17.9.5 (L1) Ensure 'Audit System Integrity' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.9.5 Ensure 'Audit System Integrity' is set to 'Success and Failure'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
17.9.5 Ensure 'Audit System Integrity' is set to 'Success and Failure'WindowsCIS Windows 7 Workstation Level 1 v3.2.0