`AU-12` Audit Record Generation

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AU Low baseline Moderate baseline High baseline

Title

Audit Record Generation

Control

a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: system components];
b. Allow [Assignment: personnel or roles] to select the event types that are to be logged by specific components of the system; and
c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

Parameters

au-12_odp.01: system components
au-12_odp.02: personnel or roles

Related controls

ac-17, ac-6, au-14, au-2, au-3, au-4, au-5, au-6, au-7, cm-5, ma-4, mp-4, pm-12, sa-8, sc-18, si-10, si-3, si-4, si-7

STIG rules that implement this control 425

Apple macOS 15 (Sequoia) V1R8

APPL-15-000190 CAT II The macOS system must configure sudo to log events.
APPL-15-001001 CAT II The macOS system must be configured to audit all administrative action events.
APPL-15-001002 CAT II The macOS system must be configured to audit all login and logout events.
APPL-15-001003 CAT II The macOS system must enable security auditing.
APPL-15-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-15-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-15-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-15-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-15-001024 CAT II The macOS system must be configured to audit all failed program execution on the system.
APPL-15-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.
APPL-15-001110 CAT II The macOS system must configure audit_control group to wheel.
APPL-15-001120 CAT II The macOS system must configure audit_control owner to root.
APPL-15-001130 CAT II The macOS system must configure audit_control owner to mode 440 or less permissive.
APPL-15-001140 CAT II The macOS system must configure audit_control to not contain access control lists (ACLs).
APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000190 CAT II The macOS system must configure sudo to log events.
APPL-26-001001 CAT II The macOS system must be configured to audit all administrative action events.
APPL-26-001002 CAT II The macOS system must be configured to audit all login and logout events.
APPL-26-001003 CAT II The macOS system must enable security auditing.
APPL-26-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-26-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-26-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-26-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-26-001024 CAT II The macOS system must be configured to audit all failed program execution on the system.
APPL-26-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.
APPL-26-001110 CAT II The macOS system must configure audit_control group to wheel.
APPL-26-001120 CAT II The macOS system must configure audit_control owner to root.
APPL-26-001130 CAT II The macOS system must configure audit_control owner to mode 440 or less permissive.
APPL-26-001140 CAT II The macOS system must configure audit_control to not contain access control lists (ACLs).
APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.

Application Security and Development V6R5

APSC-DV-000620 CAT II The application must provide audit record generation capability for the creation of session IDs.
APSC-DV-000630 CAT II The application must provide audit record generation capability for the destruction of session IDs.
APSC-DV-000640 CAT II The application must provide audit record generation capability for the renewal of session IDs.
APSC-DV-000650 CAT II The application must not write sensitive data into the application logs.
APSC-DV-000660 CAT II The application must provide audit record generation capability for session timeouts.
APSC-DV-000670 CAT II The application must record a time stamp indicating when the event occurred.
APSC-DV-000680 CAT II The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.
APSC-DV-000690 CAT II The application must provide audit record generation capability for connecting system IP addresses.
APSC-DV-000700 CAT II The application must record the username or user ID of the user associated with the event.
APSC-DV-000710 CAT II The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.
APSC-DV-000720 CAT II The application must generate audit records when successful/unsuccessful attempts to access security objects occur.
APSC-DV-000730 CAT II The application must generate audit records when successful/unsuccessful attempts to access security levels occur.
APSC-DV-000740 CAT II The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.
APSC-DV-000750 CAT II The application must generate audit records when successful/unsuccessful attempts to modify privileges occur.
APSC-DV-000760 CAT II The application must generate audit records when successful/unsuccessful attempts to modify security objects occur.
APSC-DV-000770 CAT II The application must generate audit records when successful/unsuccessful attempts to modify security levels occur.
APSC-DV-000780 CAT II The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.
APSC-DV-000790 CAT II The application must generate audit records when successful/unsuccessful attempts to delete privileges occur.
APSC-DV-000800 CAT II The application must generate audit records when successful/unsuccessful attempts to delete security levels occur.
APSC-DV-000810 CAT II The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.
APSC-DV-000820 CAT II The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.
APSC-DV-000830 CAT II The application must generate audit records when successful/unsuccessful logon attempts occur.
APSC-DV-000840 CAT II The application must generate audit records for privileged activities or other system-level access.
APSC-DV-000850 CAT II The application must generate audit records showing starting and ending time for user access to the system.
APSC-DV-000860 CAT II The application must generate audit records when successful/unsuccessful accesses to objects occur.
APSC-DV-000870 CAT II The application must generate audit records for all direct access to the information system.
APSC-DV-000880 CAT II The application must generate audit records for all account creations, modifications, disabling, and termination events.
APSC-DV-003360 CAT III The application must generate audit records when concurrent logons from different workstations occur.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
UBTU-22-653065 CAT II Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.
UBTU-22-653070 CAT II Ubuntu 22.04 LTS must permit only authorized accounts to own the audit configuration files.
UBTU-22-653075 CAT II Ubuntu 22.04 LTS must permit only authorized groups to own the audit configuration files.
UBTU-22-654010 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command.
UBTU-22-654015 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command.
UBTU-22-654020 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chage command.
UBTU-22-654025 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command.
UBTU-22-654030 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command.
UBTU-22-654035 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command.
UBTU-22-654040 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command.
UBTU-22-654041 CAT II Ubuntu 22.04 LTS must audit any script or executable called by cron as root or by any privileged user.
UBTU-22-654045 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the fdisk command.
UBTU-22-654050 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command.
UBTU-22-654055 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the kmod command.
UBTU-22-654060 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use modprobe command.
UBTU-22-654065 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the mount command.
UBTU-22-654070 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command.
UBTU-22-654075 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.
UBTU-22-654080 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command.
UBTU-22-654085 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command.
UBTU-22-654090 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command.
UBTU-22-654095 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command.
UBTU-22-654100 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the su command.
UBTU-22-654105 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command.
UBTU-22-654110 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command.
UBTU-22-654115 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the umount command.
UBTU-22-654120 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command.
UBTU-22-654125 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command.
UBTU-22-654126 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the useradd command.
UBTU-22-654130 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
UBTU-22-654135 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
UBTU-22-654140 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
UBTU-22-654145 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
UBTU-22-654150 CAT II Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
UBTU-22-654155 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.
UBTU-22-654160 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls.
UBTU-22-654165 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.
UBTU-22-654170 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module system call.
UBTU-22-654175 CAT II Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module system calls.
UBTU-22-654180 CAT II Ubuntu 22.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
UBTU-22-654185 CAT II Ubuntu 22.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls.
UBTU-22-654195 CAT II Ubuntu 22.04 LTS must generate audit records for the /var/log/btmp file.
UBTU-22-654200 CAT II Ubuntu 22.04 LTS must generate audit records for the /var/log/wtmp file.
UBTU-22-654205 CAT II Ubuntu 22.04 LTS must generate audit records for the /var/run/utmp file.
UBTU-22-654210 CAT II Ubuntu 22.04 LTS must generate audit records for the use and modification of faillog file.
UBTU-22-654215 CAT II Ubuntu 22.04 LTS must generate audit records for the use and modification of the lastlog file.
UBTU-22-654220 CAT II Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur.
UBTU-22-654225 CAT II Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur.
UBTU-22-654235 CAT II Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions and other system-level access.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
UBTU-24-200270 CAT II Ubuntu 24.04 LTS must audit any script or executable called by cron as root or by any privileged user.
UBTU-24-200280 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
UBTU-24-200290 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
UBTU-24-200300 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
UBTU-24-200310 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
UBTU-24-200320 CAT II Ubuntu 24.04 LTS must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.
UBTU-24-500010 CAT II Ubuntu 24.04 LTS must generate audit records for privileged activities, nonlocal maintenance, diagnostic sessions, and other system-level access.
UBTU-24-900040 CAT II Ubuntu 24.04 LTS must be configured so that audit configuration files are not write-accessible by unauthorized users.
UBTU-24-900050 CAT II Ubuntu 24.04 LTS must permit only authorized accounts to own the audit configuration files.
UBTU-24-900060 CAT II Ubuntu 24.04 LTS must permit only authorized groups to own the audit configuration files.
UBTU-24-900070 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the su command.
UBTU-24-900080 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command.
UBTU-24-900090 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the mount command.
UBTU-24-900100 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the umount command.
UBTU-24-900110 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent command.
UBTU-24-900120 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign command.
UBTU-24-900130 CAT II Ubuntu 24.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
UBTU-24-900140 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls.
UBTU-24-900150 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmod, and fchmodat system calls.
UBTU-24-900160 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open, openat, open_by_handle_at, truncate, and ftruncate system calls.
UBTU-24-900170 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command.
UBTU-24-900180 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit command.
UBTU-24-900190 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command.
UBTU-24-900200 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command.
UBTU-24-900210 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command.
UBTU-24-900220 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_parser command.
UBTU-24-900230 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command.
UBTU-24-900240 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command.
UBTU-24-900250 CAT II Ubuntu 24.04 LTS must generate audit records for the use and modification of faillog file.
UBTU-24-900260 CAT II Ubuntu 24.04 LTS must generate audit records for the use and modification of the lastlog file.
UBTU-24-900270 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command.
UBTU-24-900280 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update command.
UBTU-24-900290 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command.
UBTU-24-900300 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the chage command.
UBTU-24-900310 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command.
UBTU-24-900315 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the useradd command.
UBTU-24-900320 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command.
UBTU-24-900330 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestamp_check command.
UBTU-24-900340 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the init_module and finit_module syscalls.
UBTU-24-900350 CAT II Ubuntu 24.04 LTS must generate audit records for successful/unsuccessful uses of the delete_module syscall.
UBTU-24-900510 CAT II Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers file occur.
UBTU-24-900520 CAT II Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to modify the /etc/sudoers.d directory occur.
UBTU-24-900540 CAT II Ubuntu 24.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlinkat, rename, renameat, and rmdir system calls.
UBTU-24-900590 CAT II Ubuntu 24.04 LTS must generate audit records for the /var/log/wtmp file.
UBTU-24-900600 CAT II Ubuntu 24.04 LTS must generate audit records for the /var/run/utmp file.
UBTU-24-900610 CAT II Ubuntu 24.04 LTS must generate audit records for the /var/log/btmp file.
UBTU-24-900730 CAT II Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use modprobe command.
UBTU-24-900740 CAT II Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the kmod command.
UBTU-24-900750 CAT II Ubuntu 24.04 LTS must generate audit records when successful/unsuccessful attempts to use the fdisk command.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000210 CAT II The Cisco device must be configured to audit all administrator activity.
CISC-ND-001250 CAT II The Cisco router must be configured to generate log records when administrator privileges are deleted.
CISC-ND-001260 CAT II The Cisco router must be configured to generate audit records when successful/unsuccessful logon attempts occur.
CISC-ND-001270 CAT II The Cisco router must be configured to generate log records for privileged activities.

Google Android 16 COBO Y26M10

GOOG-16-007800 CAT II Google Android 16 must be configured to generate audit records for the following auditable events: Detected integrity violations.

Google Android 17 COBO Y26M06

GOOG-17-006900 CAT II Google Android 17 must be configured to generate audit records for the following auditable events: Detected integrity violations.

Google Chrome Current Windows V2R11

DTBC-0005 CAT II Extensions installation must be blocklisted by default.
DTBC-0052 CAT II Deletion of browser history must be disabled.
DTBC-0053 CAT II Prompt for download location must be enabled.
DTBC-0055 CAT II Download restrictions must be configured.
DTBC-0075 CAT II Create Themes with AI must be disabled.
DTBC-0076 CAT II DevTools Generative AI features must be disabled.
DTBC-0077 CAT II GenAI local foundational model must be disabled.
DTBC-0078 CAT II Help Me Write must be disabled.
DTBC-0079 CAT II AI-powered History Search must be disabled.
DTBC-0080 CAT II Tab Compare Settings must be disabled.

Microsoft Windows 11 V2R11

WN11-AU-000005 CAT II The system must be configured to audit Account Logon - Credential Validation failures.
WN11-AU-000010 CAT II The system must be configured to audit Account Logon - Credential Validation successes.
WN11-AU-000045 CAT II The system must be configured to audit Detailed Tracking - PNP Activity successes.
WN11-AU-000050 CAT II The system must be configured to audit Detailed Tracking - Process Creation successes.
WN11-AU-000054 CAT II The system must be configured to audit Logon/Logoff - Account Lockout failures.
WN11-AU-000060 CAT II The system must be configured to audit Logon/Logoff - Group Membership successes.
WN11-AU-000070 CAT II The system must be configured to audit Logon/Logoff - Logon failures.
WN11-AU-000075 CAT II The system must be configured to audit Logon/Logoff - Logon successes.
WN11-AU-000080 CAT II The system must be configured to audit Logon/Logoff - Special Logon successes.
WN11-AU-000081 CAT II Windows 11 must be configured to audit Object Access - File Share failures.
WN11-AU-000082 CAT II Windows 11 must be configured to audit Object Access - File Share successes.
WN11-AU-000083 CAT II Windows 11 must be configured to audit Object Access - Other Object Access Events successes.
WN11-AU-000084 CAT II Windows 11 must be configured to audit Object Access - Other Object Access Events failures.
WN11-AU-000085 CAT II The system must be configured to audit Object Access - Removable Storage failures.
WN11-AU-000090 CAT II The system must be configured to audit Object Access - Removable Storage successes.
WN11-AU-000100 CAT II The system must be configured to audit Policy Change - Audit Policy Change successes.
WN11-AU-000105 CAT II The system must be configured to audit Policy Change - Authentication Policy Change successes.
WN11-AU-000107 CAT II The system must be configured to audit Policy Change - Authorization Policy Change successes.
WN11-AU-000115 CAT II The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
WN11-AU-000120 CAT II The system must be configured to audit System - IPsec Driver failures.
WN11-AU-000130 CAT II The system must be configured to audit System - Other System Events successes.
WN11-AU-000135 CAT II The system must be configured to audit System - Other System Events failures.
WN11-AU-000140 CAT II The system must be configured to audit System - Security State Change successes.
WN11-AU-000150 CAT II The system must be configured to audit System - Security System Extension successes.
WN11-AU-000155 CAT II The system must be configured to audit System - System Integrity failures.
WN11-AU-000160 CAT II The system must be configured to audit System - System Integrity successes.
WN11-AU-000583 CAT II Windows 11 must be configured to audit handle manipulation failures.
WN11-AU-000586 CAT II Windows 11 must be configured to audit registry successes.
WN11-AU-000587 CAT II Windows 11 must be configured to audit sensitive privilege use successes.
WN11-AU-000588 CAT II Windows 11 must be configured to audit sensitive privilege use failures.
WN11-AU-000589 CAT II Windows 11 must be configured to audit registry failures.
WN11-EP-000310 CAT II Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled.
WN11-SO-000030 CAT II Audit policy using subcategories must be enabled.
WN11-UR-000130 CAT II The "Manage auditing and security log" user right must only be assigned to the Administrators group.

Microsoft Windows Server 2022 V2R11

WN22-AU-000070 CAT II Windows Server 2022 must be configured to audit Account Logon - Credential Validation successes.
WN22-AU-000080 CAT II Windows Server 2022 must be configured to audit Account Logon - Credential Validation failures.
WN22-AU-000090 CAT II Windows Server 2022 must be configured to audit Account Management - Other Account Management Events successes.
WN22-AU-000100 CAT II Windows Server 2022 must be configured to audit Account Management - Security Group Management successes.
WN22-AU-000110 CAT II Windows Server 2022 must be configured to audit Account Management - User Account Management successes.
WN22-AU-000120 CAT II Windows Server 2022 must be configured to audit Account Management - User Account Management failures.
WN22-AU-000130 CAT II Windows Server 2022 must be configured to audit Detailed Tracking - Plug and Play Events successes.
WN22-AU-000140 CAT II Windows Server 2022 must be configured to audit Detailed Tracking - Process Creation successes.
WN22-AU-000160 CAT II Windows Server 2022 must be configured to audit Logon/Logoff - Account Lockout failures.
WN22-AU-000170 CAT II Windows Server 2022 must be configured to audit Logon/Logoff - Group Membership successes.
WN22-AU-000180 CAT II Windows Server 2022 must be configured to audit logoff successes.
WN22-AU-000190 CAT II Windows Server 2022 must be configured to audit logon successes.
WN22-AU-000200 CAT II Windows Server 2022 must be configured to audit logon failures.
WN22-AU-000210 CAT II Windows Server 2022 must be configured to audit Logon/Logoff - Special Logon successes.
WN22-AU-000220 CAT II Windows Server 2022 must be configured to audit Object Access - Other Object Access Events successes.
WN22-AU-000230 CAT II Windows Server 2022 must be configured to audit Object Access - Other Object Access Events failures.
WN22-AU-000240 CAT II Windows Server 2022 must be configured to audit Object Access - Removable Storage successes.
WN22-AU-000250 CAT II Windows Server 2022 must be configured to audit Object Access - Removable Storage failures.
WN22-AU-000260 CAT II Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change successes.
WN22-AU-000270 CAT II Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change failures.
WN22-AU-000280 CAT II Windows Server 2022 must be configured to audit Policy Change - Authentication Policy Change successes.
WN22-AU-000290 CAT II Windows Server 2022 must be configured to audit Policy Change - Authorization Policy Change successes.
WN22-AU-000300 CAT II Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
WN22-AU-000310 CAT II Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
WN22-AU-000320 CAT II Windows Server 2022 must be configured to audit System - IPsec Driver successes.
WN22-AU-000330 CAT II Windows Server 2022 must be configured to audit System - IPsec Driver failures.
WN22-AU-000340 CAT II Windows Server 2022 must be configured to audit System - Other System Events successes.
WN22-AU-000350 CAT II Windows Server 2022 must be configured to audit System - Other System Events failures.
WN22-AU-000360 CAT II Windows Server 2022 must be configured to audit System - Security State Change successes.
WN22-AU-000370 CAT II Windows Server 2022 must be configured to audit System - Security System Extension successes.
WN22-AU-000380 CAT II Windows Server 2022 must be configured to audit System - System Integrity successes.
WN22-AU-000390 CAT II Windows Server 2022 must be configured to audit System - System Integrity failures.
WN22-AU-000583 CAT II Windows Server 2022 must be configured to audit handle manipulation failures.
WN22-AU-000585 CAT II Windows Server 2022 must be configured to audit registry failures.
WN22-AU-000586 CAT II Windows Server 2022 must be configured to audit registry successes.
WN22-AU-000587 CAT II Windows Server 2022 must be configured to audit sensitive privilege use successes.
WN22-AU-000588 CAT II Windows Server 2022 must be configured to audit sensitive privilege use failures.
WN22-DC-000170 CAT II Windows Server 2022 Active Directory Group Policy objects must be configured with proper audit settings.
WN22-DC-000180 CAT II Windows Server 2022 Active Directory Domain object must be configured with proper audit settings.
WN22-DC-000190 CAT II Windows Server 2022 Active Directory Infrastructure object must be configured with proper audit settings.
WN22-DC-000200 CAT II Windows Server 2022 Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
WN22-DC-000210 CAT II Windows Server 2022 Active Directory AdminSDHolder object must be configured with proper audit settings.
WN22-DC-000220 CAT II Windows Server 2022 Active Directory RID Manager$ object must be configured with proper audit settings.
WN22-DC-000230 CAT II Windows Server 2022 must be configured to audit Account Management - Computer Account Management successes.
WN22-DC-000240 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Access successes.
WN22-DC-000250 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Access failures.
WN22-DC-000260 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Changes successes.
WN22-SO-000050 CAT II Windows Server 2022 must force audit policy subcategory settings to override audit policy category settings.
WN22-UR-000170 CAT II Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.

Microsoft Windows Server 2025 V1R4

WN25-AU-000070 CAT II Windows Server 2025 must be configured to audit Account Logon - Credential Validation successes.
WN25-AU-000080 CAT II Windows Server 2025 must be configured to audit Account Logon - Credential Validation failures.
WN25-AU-000090 CAT II Windows Server 2025 must be configured to audit Account Management - Other Account Management Events successes.
WN25-AU-000100 CAT II Windows Server 2025 must be configured to audit Account Management - Security Group Management successes.
WN25-AU-000110 CAT II Windows Server 2025 must be configured to audit Account Management - User Account Management successes.
WN25-AU-000120 CAT II Windows Server 2025 must be configured to audit Account Management - User Account Management failures.
WN25-AU-000130 CAT II Windows Server 2025 must be configured to audit Detailed Tracking - Plug and Play Events successes.
WN25-AU-000140 CAT II Windows Server 2025 must be configured to audit Detailed Tracking - Process Creation successes.
WN25-AU-000150 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout successes.
WN25-AU-000160 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout failures.
WN25-AU-000170 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Group Membership successes.
WN25-AU-000180 CAT II Windows Server 2025 must be configured to audit logoff successes.
WN25-AU-000190 CAT II Windows Server 2025 must be configured to audit logon successes.
WN25-AU-000200 CAT II Windows Server 2025 must be configured to audit logon failures.
WN25-AU-000210 CAT II Windows Server 2025 must be configured to audit Logon/Logoff - Special Logon successes.
WN25-AU-000220 CAT II Windows Server 2025 must be configured to audit Object Access - Other Object Access Events successes.
WN25-AU-000230 CAT II Windows Server 2025 must be configured to audit Object Access - Other Object Access Events failures.
WN25-AU-000240 CAT II Windows Server 2025 must be configured to audit Object Access - Removable Storage successes.
WN25-AU-000250 CAT II Windows Server 2025 must be configured to audit Object Access - Removable Storage failures.
WN25-AU-000260 CAT II Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change successes.
WN25-AU-000270 CAT II Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change failures.
WN25-AU-000280 CAT II Windows Server 2025 must be configured to audit Policy Change - Authentication Policy Change successes.
WN25-AU-000281 CAT II Windows Server 2025 must be configured to audit Policy Change - Authorization Policy Change successes.
WN25-AU-000300 CAT II Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
WN25-AU-000310 CAT II Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
WN25-AU-000320 CAT II Windows Server 2025 must be configured to audit System - IPsec Driver successes.
WN25-AU-000330 CAT II Windows Server 2025 must be configured to audit System - IPsec Driver failures.
WN25-AU-000340 CAT II Windows Server 2025 must be configured to audit System - Other System Events successes.
WN25-AU-000350 CAT II Windows Server 2025 must be configured to audit System - Other System Events failures.
WN25-AU-000360 CAT II Windows Server 2025 must be configured to audit System - Security State Change successes.
WN25-AU-000370 CAT II Windows Server 2025 must be configured to audit System - Security System Extension successes.
WN25-AU-000380 CAT II Windows Server 2025 must be configured to audit System - System Integrity successes.
WN25-AU-000390 CAT II Windows Server 2025 must be configured to audit System - System Integrity failures.
WN25-AU-000583 CAT II Windows Server 2025 must be configured to audit handle manipulation failures.
WN25-AU-000585 CAT II Windows Server 2025 must be configured to audit registry failures.
WN25-AU-000586 CAT II Windows Server 2025 must be configured to audit registry successes.
WN25-AU-000587 CAT II Windows Server 2025 must be configured to audit sensitive privilege use successes.
WN25-AU-000588 CAT II Windows Server 2025 must be configured to audit sensitive privilege use failures.
WN25-DC-000170 CAT II Windows Server 2025 Active Directory Group Policy Objects (GPOs) must be configured with proper audit settings.
WN25-DC-000180 CAT II Windows Server 2025 Active Directory (AD) Domain object must be configured with proper audit settings.
WN25-DC-000190 CAT II Windows Server 2025 Active Directory (AD) Infrastructure object must be configured with proper audit settings.
WN25-DC-000200 CAT II Windows Server 2025 Active Directory (AD) Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
WN25-DC-000210 CAT II Windows Server 2025 Active Directory (AD) AdminSDHolder object must be configured with proper audit settings.
WN25-DC-000220 CAT II Windows Server 2025 Active Directory (AD) RID Manager$ object must be configured with proper audit settings.
WN25-DC-000230 CAT II Windows Server 2025 must be configured to audit Account Management - Computer Account Management successes.
WN25-DC-000240 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Access successes.
WN25-DC-000250 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Access failures.
WN25-DC-000260 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Changes successes.
WN25-DC-000270 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Changes failures.
WN25-SO-000050 CAT II Windows Server 2025 must force audit policy subcategory settings to override audit policy category settings.
WN25-UR-000170 CAT II The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200563 CAT II RHEL 10 must enable audit logging for the USBGuard daemon.
RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
RHEL-10-400195 CAT II RHEL 10 must enforce root ownership of the "/etc/audit/" directory.
RHEL-10-400200 CAT II RHEL 10 must enforce root group ownership of the "/etc/audit/" directory.
RHEL-10-500010 CAT II RHEL 10 must audit local events.
RHEL-10-500025 CAT II RHEL 10 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
RHEL-10-500310 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
RHEL-10-500320 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.
RHEL-10-500330 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.
RHEL-10-500340 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.
RHEL-10-500350 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.
RHEL-10-500360 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.
RHEL-10-500370 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.
RHEL-10-500380 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.
RHEL-10-500390 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
RHEL-10-500400 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.
RHEL-10-500410 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.
RHEL-10-500420 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.
RHEL-10-500430 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.
RHEL-10-500440 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.
RHEL-10-500450 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.
RHEL-10-500460 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.
RHEL-10-500470 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.
RHEL-10-500480 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.
RHEL-10-500490 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.
RHEL-10-500500 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.
RHEL-10-500510 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.
RHEL-10-500520 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.
RHEL-10-500530 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.
RHEL-10-500540 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
RHEL-10-500550 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
RHEL-10-500560 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
RHEL-10-500570 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.
RHEL-10-500580 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.
RHEL-10-500590 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.
RHEL-10-500600 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.
RHEL-10-500610 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.
RHEL-10-500620 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "init" command.
RHEL-10-500630 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "poweroff" command.
RHEL-10-500640 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "reboot" command.
RHEL-10-500650 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the shutdown command.
RHEL-10-500660 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount" system call.
RHEL-10-500670 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "umount2" system call.
RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
RHEL-10-500750 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/faillock".
RHEL-10-500760 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".
RHEL-10-500780 CAT II RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.
RHEL-10-500790 CAT II RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.
RHEL-10-500810 CAT II RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.
RHEL-10-900000 CAT II RHEL 10 must enforce mode "0640" or less for the "/etc/audit/auditd.conf" file to prevent unauthorized access.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212055 CAT III RHEL 9 must enable auditing of processes that start prior to the audit daemon.
RHEL-09-291025 CAT III RHEL 9 must enable Linux audit logging for the USBGuard daemon.
RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
RHEL-09-653075 CAT II RHEL 9 audit system must audit local events.
RHEL-09-653110 CAT II RHEL 9 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
RHEL-09-654015 CAT II RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
RHEL-09-654020 CAT II RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
RHEL-09-654025 CAT II RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
RHEL-09-654030 CAT II RHEL 9 must audit all uses of umount system calls.
RHEL-09-654035 CAT II RHEL 9 must audit all uses of the chacl command.
RHEL-09-654040 CAT II RHEL 9 must audit all uses of the setfacl command.
RHEL-09-654045 CAT II RHEL 9 must audit all uses of the chcon command.
RHEL-09-654050 CAT II RHEL 9 must audit all uses of the semanage command.
RHEL-09-654055 CAT II RHEL 9 must audit all uses of the setfiles command.
RHEL-09-654060 CAT II RHEL 9 must audit all uses of the setsebool command.
RHEL-09-654065 CAT II RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
RHEL-09-654070 CAT II RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
RHEL-09-654075 CAT II RHEL 9 must audit all uses of the delete_module system call.
RHEL-09-654080 CAT II RHEL 9 must audit all uses of the init_module and finit_module system calls.
RHEL-09-654085 CAT II RHEL 9 must audit all uses of the chage command.
RHEL-09-654090 CAT II RHEL 9 must audit all uses of the chsh command.
RHEL-09-654095 CAT II RHEL 9 must audit all uses of the crontab command.
RHEL-09-654097 CAT II RHEL 9 must audit any script or executable called by cron as root or by any privileged user.
RHEL-09-654100 CAT II RHEL 9 must audit all uses of the gpasswd command.
RHEL-09-654105 CAT II RHEL 9 must audit all uses of the kmod command.
RHEL-09-654110 CAT II RHEL 9 must audit all uses of the newgrp command.
RHEL-09-654115 CAT II RHEL 9 must audit all uses of the pam_timestamp_check command.
RHEL-09-654120 CAT II RHEL 9 must audit all uses of the passwd command.
RHEL-09-654125 CAT II RHEL 9 must audit all uses of the postdrop command.
RHEL-09-654130 CAT II RHEL 9 must audit all uses of the postqueue command.
RHEL-09-654135 CAT II RHEL 9 must audit all uses of the ssh-agent command.
RHEL-09-654140 CAT II RHEL 9 must audit all uses of the ssh-keysign command.
RHEL-09-654145 CAT II RHEL 9 must audit all uses of the su command.
RHEL-09-654150 CAT II RHEL 9 must audit all uses of the sudo command.
RHEL-09-654155 CAT II RHEL 9 must audit all uses of the sudoedit command.
RHEL-09-654160 CAT II RHEL 9 must audit all uses of the unix_chkpwd command.
RHEL-09-654165 CAT II RHEL 9 must audit all uses of the unix_update command.
RHEL-09-654170 CAT II RHEL 9 must audit all uses of the userhelper command.
RHEL-09-654175 CAT II RHEL 9 must audit all uses of the usermod command.
RHEL-09-654180 CAT II RHEL 9 must audit all uses of the mount command.
RHEL-09-654185 CAT II Successful/unsuccessful uses of the init command in RHEL 9 must generate an audit record.
RHEL-09-654190 CAT II Successful/unsuccessful uses of the poweroff command in RHEL 9 must generate an audit record.
RHEL-09-654195 CAT II Successful/unsuccessful uses of the reboot command in RHEL 9 must generate an audit record.
RHEL-09-654200 CAT II Successful/unsuccessful uses of the shutdown command in RHEL 9 must generate an audit record.
RHEL-09-654205 CAT II Successful/unsuccessful uses of the umount system call in RHEL 9 must generate an audit record.
RHEL-09-654210 CAT II Successful/unsuccessful uses of the umount2 system call in RHEL 9 must generate an audit record.
RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
RHEL-09-654250 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/faillock.
RHEL-09-654255 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.
RHEL-09-654270 CAT II RHEL 9 audit system must protect logon UIDs from unauthorized change.

AU-12 Audit Record Generation