Detections
Analytics

CSCv7|6.2

Title

Activate audit logging

Description

Ensure that local logging has been enabled on all systems and networking devices.

Reference Item Details

Category: Maintenance, Monitoring and Analysis of Audit Logs

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.1.1 Syslog logging should be configuredPalo_AltoCIS Palo Alto Firewall 11 v1.1.0 L1
1.1.1.1 Syslog logging should be configuredPalo_AltoCIS Palo Alto Firewall 10 v1.2.0 L1
1.1.1.1 Syslog logging should be configured - configurationPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.1 Syslog logging should be configured - hip matchPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.1 Syslog logging should be configured - hostPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.1 Syslog logging should be configured - ip-tagPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.1 Syslog logging should be configured - systemPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.1 Syslog logging should be configured - user-idPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.1.2 SNMPv3 traps should be configuredPalo_AltoCIS Palo Alto Firewall 10 v1.2.0 L2
1.1.1.2 SNMPv3 traps should be configuredPalo_AltoCIS Palo Alto Firewall 11 v1.1.0 L2
1.1.1.2 SNMPv3 traps should be configured - configurationPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L2
1.1.1.2 SNMPv3 traps should be configured - hip matchPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L2
1.1.1.2 SNMPv3 traps should be configured - hostPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L2
1.1.1.2 SNMPv3 traps should be configured - ip-tagPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L2
1.1.1.2 SNMPv3 traps should be configured - user-idPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L2
1.1.2 Ensure 'Enable Log on High DP Load' is enabledPalo_AltoCIS Palo Alto Firewall 8 Benchmark L1 v1.0.0
1.1.3 Ensure 'Enable Log on High DP Load' is enabledPalo_AltoCIS Palo Alto Firewall 10 v1.2.0 L1
1.1.3 Ensure 'Enable Log on High DP Load' is enabledPalo_AltoCIS Palo Alto Firewall 9 v1.1.0 L1
1.1.3 Ensure 'Enable Log on High DP Load' is enabledPalo_AltoCIS Palo Alto Firewall 11 v1.1.0 L1
1.1.3 Ensure auditing is configured for the Docker daemonUnixCIS Docker v1.8.0 L1 OS Linux
1.1.15 Ensure that the --audit-log-path argument is set as appropriateUnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
1.2.16 Ensure that the --audit-log-path argument is setUnixCIS Kubernetes v1.12.0 L1 Master Node
1.2.18 Ensure that the --audit-log-path argument is setUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.2.18 Ensure that the --audit-log-path argument is setOpenShiftCIS Red Hat OpenShift Container Platform v1.8.0 L1 OpenShift
1.2.18 Ensure that the --audit-log-path argument is setUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.2.21 Ensure that the --audit-log-path argument is setUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.7 (L1) Host integrated hardware management controller must enable remote logging of eventsVMwareCIS VMware ESXi 8.0 v1.2.0 L1
1.10 UBTU-24-100200UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT II
1.10.1 Ensure 'logging' is enabledCiscoCIS Cisco Firewall ASA 9 L1 v4.1.0
1.10.1 Ensure 'logging' is enabledCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
1.10.4 Ensure 'logging with the device ID' is configured correctlyCiscoCIS Cisco ASA 9.x Firewall L1 v1.1.0
1.10.5 Ensure 'logging with the device ID' is configured correctlyCiscoCIS Cisco Firewall ASA 9 L1 v4.1.0
1.13 UBTU-24-100400UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT II
1.14 UBTU-24-100410UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT II
1.15 UBTU-24-100450UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT III
1.117 UBTU-22-652010UnixCIS Ubuntu Linux 22.04 LTS STIG v1.0.0 CAT II
1.119 UBTU-22-653010UnixCIS Ubuntu Linux 22.04 LTS STIG v1.0.0 CAT II
1.120 UBTU-22-653015UnixCIS Ubuntu Linux 22.04 LTS STIG v1.0.0 CAT II
1.121 UBTU-22-653020UnixCIS Ubuntu Linux 22.04 LTS STIG v1.0.0 CAT III
1.188 UBTU-24-909000UnixCIS Ubuntu Linux 24.04 LTS STIG v1.0.0 CAT II
17.6.3 (L1) Ensure 'Audit Other Object Access Events' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker
17.6.3 Ensure 'Audit Other Object Access Events' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.1 L1
18.10.43.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 10 EMS Gateway v3.0.0 L1
18.10.44.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v4.0.0 L1
18.10.44.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v4.0.0 L1 BitLocker
18.10.44.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v4.0.0 L1
18.10.44.1 (L1) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v4.0.0 L1 BL
18.10.44.1 (NG) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v4.0.0 L1 NG
18.10.44.1 (NG) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v4.0.0 L1 NG
18.10.44.1 (NG) Ensure 'Allow auditing events in Microsoft Defender Application Guard' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v4.0.0 L1 BL NG