`MA-04(01)` Logging and Review

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged MA part of MA-4

Title

Logging and Review

Control

(a) Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and
(b) Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.

Discussion

Audit logging for nonlocal maintenance is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).

Parameters

ma-4.1_prm_1: organization-defined audit events
ma-04.01_odp.01: audit events
ma-04.01_odp.02: audit events

Related controls

au-12, au-6

STIG rules that implement this control 115

Apple macOS 15 (Sequoia) V1R8

APPL-15-001001 CAT II The macOS system must be configured to audit all administrative action events.
APPL-15-001002 CAT II The macOS system must be configured to audit all login and logout events.
APPL-15-001003 CAT II The macOS system must enable security auditing.
APPL-15-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-15-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-15-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-15-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-15-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.

Apple macOS 26 (Tahoe) V1R4

APPL-26-001001 CAT II The macOS system must be configured to audit all administrative action events.
APPL-26-001002 CAT II The macOS system must be configured to audit all login and logout events.
APPL-26-001003 CAT II The macOS system must enable security auditing.
APPL-26-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-26-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-26-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-26-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-26-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.

Application Security and Development V6R5

APSC-DV-001930 CAT II Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-654235 CAT II Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-500010 CAT II Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
RHEL-10-500310 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
RHEL-10-500320 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.
RHEL-10-500330 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.
RHEL-10-500340 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.
RHEL-10-500350 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.
RHEL-10-500360 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.
RHEL-10-500370 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.
RHEL-10-500380 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.
RHEL-10-500390 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
RHEL-10-500400 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.
RHEL-10-500410 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.
RHEL-10-500420 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.
RHEL-10-500430 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.
RHEL-10-500440 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.
RHEL-10-500450 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.
RHEL-10-500460 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.
RHEL-10-500470 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.
RHEL-10-500480 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.
RHEL-10-500490 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.
RHEL-10-500500 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.
RHEL-10-500510 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.
RHEL-10-500520 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.
RHEL-10-500530 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.
RHEL-10-500540 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
RHEL-10-500550 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
RHEL-10-500560 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
RHEL-10-500570 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.
RHEL-10-500580 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.
RHEL-10-500590 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.
RHEL-10-500600 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.
RHEL-10-500610 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.
RHEL-10-500660 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call.
RHEL-10-500670 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call.
RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
RHEL-10-500750 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock".
RHEL-10-500760 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".
RHEL-10-500780 CAT II RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.
RHEL-10-500790 CAT II RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.
RHEL-10-500810 CAT II RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212055 CAT III RHEL 9 must enable auditing of processes that start prior to the audit daemon.
RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
RHEL-09-654015 CAT II RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
RHEL-09-654020 CAT II RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
RHEL-09-654025 CAT II RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
RHEL-09-654030 CAT II RHEL 9 must audit all uses of umount system calls.
RHEL-09-654035 CAT II RHEL 9 must audit all uses of the chacl command.
RHEL-09-654040 CAT II RHEL 9 must audit all uses of the setfacl command.
RHEL-09-654045 CAT II RHEL 9 must audit all uses of the chcon command.
RHEL-09-654050 CAT II RHEL 9 must audit all uses of the semanage command.
RHEL-09-654055 CAT II RHEL 9 must audit all uses of the setfiles command.
RHEL-09-654060 CAT II RHEL 9 must audit all uses of the setsebool command.
RHEL-09-654065 CAT II RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
RHEL-09-654070 CAT II RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
RHEL-09-654075 CAT II RHEL 9 must audit all uses of the delete_module system call.
RHEL-09-654080 CAT II RHEL 9 must audit all uses of the init_module and finit_module system calls.
RHEL-09-654085 CAT II RHEL 9 must audit all uses of the chage command.
RHEL-09-654090 CAT II RHEL 9 must audit all uses of the chsh command.
RHEL-09-654095 CAT II RHEL 9 must audit all uses of the crontab command.
RHEL-09-654100 CAT II RHEL 9 must audit all uses of the gpasswd command.
RHEL-09-654105 CAT II RHEL 9 must audit all uses of the kmod command.
RHEL-09-654110 CAT II RHEL 9 must audit all uses of the newgrp command.
RHEL-09-654115 CAT II RHEL 9 must audit all uses of the pam_timestamp_check command.
RHEL-09-654120 CAT II RHEL 9 must audit all uses of the passwd command.
RHEL-09-654125 CAT II RHEL 9 must audit all uses of the postdrop command.
RHEL-09-654130 CAT II RHEL 9 must audit all uses of the postqueue command.
RHEL-09-654135 CAT II RHEL 9 must audit all uses of the ssh-agent command.
RHEL-09-654140 CAT II RHEL 9 must audit all uses of the ssh-keysign command.
RHEL-09-654145 CAT II RHEL 9 must audit all uses of the su command.
RHEL-09-654150 CAT II RHEL 9 must audit all uses of the sudo command.
RHEL-09-654155 CAT II RHEL 9 must audit all uses of the sudoedit command.
RHEL-09-654160 CAT II RHEL 9 must audit all uses of the unix_chkpwd command.
RHEL-09-654165 CAT II RHEL 9 must audit all uses of the unix_update command.
RHEL-09-654170 CAT II RHEL 9 must audit all uses of the userhelper command.
RHEL-09-654175 CAT II RHEL 9 must audit all uses of the usermod command.
RHEL-09-654180 CAT II RHEL 9 must audit all uses of the mount command.
RHEL-09-654205 CAT II Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
RHEL-09-654210 CAT II Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
RHEL-09-654250 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
RHEL-09-654255 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.

MA-04(01) Logging and Review