CyberStrikeus/CyberStrike - Page 15

cis-ubuntu1804-v220-5-2-1-3

Configure grub2 to enable auditing for processes that start prior to auditd daemon startup

cis-ubuntu1804-v220-5-2-1-4

Configure the audit_backlog_limit kernel parameter to prevent audit event loss

cis-ubuntu1804-v220-5-2-2-1

Configure the maximum size of audit log files to prevent system impact and audit data loss

cis-ubuntu1804-v220-5-2-2-2

Configure auditd to keep audit logs and never delete them automatically

cis-ubuntu1804-v220-5-2-2-3

Configure the system to halt when audit logs are full to prevent data loss

cis-ubuntu1804-v220-5-2-3-1

Ensure changes to system administration scope (sudoers) is collected

cis-ubuntu1804-v220-5-2-3-10

Ensure unsuccessful unauthorized file access attempts are collected

cis-ubuntu1804-v220-5-2-3-11

Ensure successful file system mounts are collected

cis-ubuntu1804-v220-5-2-3-12

Ensure login and logout events are collected

cis-ubuntu1804-v220-5-2-3-13

Ensure file deletion events by users are collected

cis-ubuntu1804-v220-5-2-3-14

Ensure events that modify the system's Mandatory Access Controls are collected

cis-ubuntu1804-v220-5-2-3-15

Ensure successful and unsuccessful attempts to use the chcon command are recorded

cis-ubuntu1804-v220-5-2-3-16

Ensure successful and unsuccessful attempts to use the setfacl command are recorded

cis-ubuntu1804-v220-5-2-3-17

Ensure successful and unsuccessful attempts to use the chacl command are recorded

cis-ubuntu1804-v220-5-2-3-18

Ensure successful and unsuccessful attempts to use the usermod command are recorded

cis-ubuntu1804-v220-5-2-3-19

Ensure kernel module loading and unloading is collected

cis-ubuntu1804-v220-5-2-3-2

Ensure actions as another user are always logged

cis-ubuntu1804-v220-5-2-3-20

Ensure the audit configuration is immutable

cis-ubuntu1804-v220-5-2-3-21

Ensure the running and on disk configuration is the same

cis-ubuntu1804-v220-5-2-3-3

Ensure events that modify the sudo log file are collected

cis-ubuntu1804-v220-5-2-3-4

Ensure events that modify date and time information are collected

cis-ubuntu1804-v220-5-2-3-5

Ensure events that modify the system's network environment are collected

cis-ubuntu1804-v220-5-2-3-6

Ensure use of privileged commands are collected

cis-ubuntu1804-v220-5-2-3-7

Ensure unsuccessful file access attempts are collected

cis-ubuntu1804-v220-5-2-3-8

Ensure events that modify user/group information are collected

cis-ubuntu1804-v220-5-2-3-9

Ensure discretionary access control permission modification events are collected

cis-ubuntu1804-v220-5-2-4-1

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-10

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-11

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-2

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-3

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-4

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-5

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-6

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-7

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-8

version: "2.2.0"

cis-ubuntu1804-v220-5-2-4-9

version: "2.2.0"

cis-ubuntu2004-v300-1-1-1-10

Ensure unused filesystems kernel modules are not available

cis-ubuntu2004-v300-1-1-1-7

Ensure squashfs kernel module is not available

cis-ubuntu2004-v300-1-1-2-1-2

Ensure nodev option set on /tmp partition