`AU-03(01)` Additional Audit Information

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AU Moderate baseline High baseline part of AU-3

Title

Additional Audit Information

Control

Generate audit records containing the following additional information: [Assignment: additional information].

Discussion

The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records including, but not limited to, access control or flow control rules invoked and individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements. This facilitates the use of audit trails and audit logs by not including information in audit records that could potentially be misleading, make it more difficult to locate information of interest, or increase the risk to individuals' privacy.

Parameters

au-03.01_odp: additional information

Assessment objective

AU-03(01) generated audit records contain the following [Assignment: additional information].

STIG rules that implement this control 105

Apple macOS 15 (Sequoia) V1R8

APPL-15-001003 CAT II The macOS system must enable security auditing.

Apple macOS 26 (Tahoe) V1R4

APPL-26-001003 CAT II The macOS system must enable security auditing.

Application Security and Development V6R5

APSC-DV-001030 CAT II The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.
APSC-DV-001040 CAT II The application must implement transaction recovery logs when transaction based.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000330 CAT II The Cisco router must be configured to generate audit records containing the full-text recording of privileged commands.

Microsoft Windows 11 V2R11

WN11-CC-000066 CAT II Command line data must be included in process creation events.
WN11-CC-000326 CAT II PowerShell script block logging must be enabled on Windows 11.

Microsoft Windows Server 2022 V2R11

WN22-CC-000090 CAT II Windows Server 2022 command line data must be included in process creation events.
WN22-CC-000460 CAT II Windows Server 2022 PowerShell script block logging must be enabled.

Microsoft Windows Server 2025 V1R4

WN25-CC-000090 CAT II Windows Server 2025 command line data must be included in process creation events.
WN25-CC-000460 CAT II Windows Server 2025 PowerShell script block logging must be enabled.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
RHEL-10-500310 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" system calls.
RHEL-10-500320 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of "umount" system calls.
RHEL-10-500330 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chacl" command.
RHEL-10-500340 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfacl" command.
RHEL-10-500350 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chcon" command.
RHEL-10-500360 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "semanage" command.
RHEL-10-500370 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setfiles" command.
RHEL-10-500380 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "setsebool" command.
RHEL-10-500390 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "truncate", "ftruncate", "creat", "open", "openat", and "open_by_handle_at" system calls.
RHEL-10-500400 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "delete_module" system call.
RHEL-10-500410 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "init_module" and "finit_module" system calls.
RHEL-10-500420 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chage" command.
RHEL-10-500430 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "chsh" command.
RHEL-10-500440 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "crontab" command.
RHEL-10-500450 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "gpasswd" command.
RHEL-10-500460 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "kmod" command.
RHEL-10-500470 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "newgrp" command.
RHEL-10-500480 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "pam_timestamp_check" command.
RHEL-10-500490 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "passwd" command.
RHEL-10-500500 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postdrop" command.
RHEL-10-500510 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "postqueue" command.
RHEL-10-500520 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the ssh-agent command.
RHEL-10-500530 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "ssh-keysign" command.
RHEL-10-500540 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "su" command.
RHEL-10-500550 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudo" command.
RHEL-10-500560 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "sudoedit" command.
RHEL-10-500570 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_chkpwd" command.
RHEL-10-500580 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "unix_update" command.
RHEL-10-500590 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "userhelper" command.
RHEL-10-500600 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "usermod" command.
RHEL-10-500610 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "mount" command.
RHEL-10-500680 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers".
RHEL-10-500690 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect the "/etc/sudoers.d/" directory.
RHEL-10-500700 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group".
RHEL-10-500710 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
RHEL-10-500720 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd".
RHEL-10-500730 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd".
RHEL-10-500740 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/shadow".
RHEL-10-500760 CAT II RHEL 10 must generate audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog".
RHEL-10-500780 CAT II RHEL 10 must generate audit records for all uses of the "chmod", "fchmod", "fchmodat", and "fchmodat2" syscalls.
RHEL-10-500790 CAT II RHEL 10 must generate audit records for all uses of the "chown", "fchown", "fchownat", and "lchown" syscalls.
RHEL-10-500810 CAT II RHEL 10 must generate audit records for all uses of the "rename", "unlink", "rmdir", "renameat", "renameat2", and "unlinkat" system calls.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212055 CAT III RHEL 9 must enable auditing of processes that start prior to the audit daemon.
RHEL-09-411030 CAT II RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
RHEL-09-654015 CAT II RHEL 9 must audit all uses of the chmod, fchmod, and fchmodat system calls.
RHEL-09-654020 CAT II RHEL 9 must audit all uses of the chown, fchown, fchownat, and lchown system calls.
RHEL-09-654025 CAT II RHEL 9 must audit all uses of the setxattr, fsetxattr, lsetxattr, removexattr, fremovexattr, and lremovexattr system calls.
RHEL-09-654035 CAT II RHEL 9 must audit all uses of the chacl command.
RHEL-09-654040 CAT II RHEL 9 must audit all uses of the setfacl command.
RHEL-09-654045 CAT II RHEL 9 must audit all uses of the chcon command.
RHEL-09-654050 CAT II RHEL 9 must audit all uses of the semanage command.
RHEL-09-654055 CAT II RHEL 9 must audit all uses of the setfiles command.
RHEL-09-654060 CAT II RHEL 9 must audit all uses of the setsebool command.
RHEL-09-654065 CAT II RHEL 9 must audit all uses of the rename, unlink, rmdir, renameat, and unlinkat system calls.
RHEL-09-654070 CAT II RHEL 9 must audit all uses of the truncate, ftruncate, creat, open, openat, and open_by_handle_at system calls.
RHEL-09-654075 CAT II RHEL 9 must audit all uses of the delete_module system call.
RHEL-09-654080 CAT II RHEL 9 must audit all uses of the init_module and finit_module system calls.
RHEL-09-654085 CAT II RHEL 9 must audit all uses of the chage command.
RHEL-09-654090 CAT II RHEL 9 must audit all uses of the chsh command.
RHEL-09-654095 CAT II RHEL 9 must audit all uses of the crontab command.
RHEL-09-654100 CAT II RHEL 9 must audit all uses of the gpasswd command.
RHEL-09-654105 CAT II RHEL 9 must audit all uses of the kmod command.
RHEL-09-654110 CAT II RHEL 9 must audit all uses of the newgrp command.
RHEL-09-654115 CAT II RHEL 9 must audit all uses of the pam_timestamp_check command.
RHEL-09-654120 CAT II RHEL 9 must audit all uses of the passwd command.
RHEL-09-654125 CAT II RHEL 9 must audit all uses of the postdrop command.
RHEL-09-654130 CAT II RHEL 9 must audit all uses of the postqueue command.
RHEL-09-654135 CAT II RHEL 9 must audit all uses of the ssh-agent command.
RHEL-09-654140 CAT II RHEL 9 must audit all uses of the ssh-keysign command.
RHEL-09-654145 CAT II RHEL 9 must audit all uses of the su command.
RHEL-09-654150 CAT II RHEL 9 must audit all uses of the sudo command.
RHEL-09-654155 CAT II RHEL 9 must audit all uses of the sudoedit command.
RHEL-09-654160 CAT II RHEL 9 must audit all uses of the unix_chkpwd command.
RHEL-09-654165 CAT II RHEL 9 must audit all uses of the unix_update command.
RHEL-09-654170 CAT II RHEL 9 must audit all uses of the userhelper command.
RHEL-09-654175 CAT II RHEL 9 must audit all uses of the usermod command.
RHEL-09-654180 CAT II RHEL 9 must audit all uses of the mount command.
RHEL-09-654215 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.
RHEL-09-654220 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/directory.
RHEL-09-654225 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.
RHEL-09-654230 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.
RHEL-09-654235 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd.
RHEL-09-654240 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.
RHEL-09-654245 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.
RHEL-09-654255 CAT II RHEL 9 must generate audit records for all account creations, modifications, disabling, and termination events that affect /var/log/lastlog.

AU-03(01) Additional Audit Information