STIGhub
STIGs
RMF Controls
Compare
← AU-3 — Content of Audit Records
CCI-000132
Definition
Ensure that audit records containing information that establishes where the event occurred.
Parent Control
AU-3
Content of Audit Records
Audit and Accountability
Linked STIG Checks (184)
V-204648
CAT II
AAA Services configuration audit records must identify where the events occurred.
AAA Services Security Requirements Guide
V-279034
CAT III
ColdFusion must produce log records containing information to establish what type of events occurred.
Adobe ColdFusion Security Technical Implementation Guide
V-279035
CAT III
ColdFusion must log scheduled tasks.
Adobe ColdFusion Security Technical Implementation Guide
V-274017
CAT II
Amazon Linux 2023 must have the audit package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268090
CAT II
The NixOS audit package must be installed.
Anduril NixOS Security Technical Implementation Guide
V-214232
CAT II
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214311
CAT II
The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222940
CAT II
Remote hostname must be logged.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222941
CAT III
HTTP status code must be logged.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222942
CAT II
The first line of request must be logged.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252464
CAT II
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257170
CAT II
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204930
CAT II
The ALG must produce audit records containing information to establish where the events occurred.
Application Layer Gateway Security Requirements Guide
V-222474
CAT II
The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.
Application Security and Development Security Technical Implementation Guide
V-204723
CAT II
The application server must produce log records containing sufficient information to establish where the events occurred.
Application Server Security Requirements Guide
V-237323
CAT I
The ArcGIS Server must provide audit record generation capability for DoD-defined auditable events within all application components.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-256008
CAT II
The Arista router must be configured to produce audit records containing information to establish where the events occurred.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-255962
CAT II
The Arista network device must be configured to capture all DOD auditable events.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-256008
CAT II
The Arista router must be configured to produce audit records containing information to establish where the events occurred.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-272370
CAT II
The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.
BIND 9.x Security Technical Implementation Guide
V-219225
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238298
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260590
CAT II
Ubuntu 22.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260591
CAT II
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270656
CAT II
Ubuntu 24.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270657
CAT II
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221910
CAT III
The Central Log Server must produce audit records containing information to establish where the events occurred.
Central Log Server Security Requirements Guide
V-271939
CAT II
The Cisco ACI must automatically audit account creation.
Cisco ACI NDM Security Technical Implementation Guide
V-239875
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish where the event was detected.
Cisco ASA IPS Security Technical Implementation Guide
V-239907
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish where the events occurred.
Cisco ASA NDM Security Technical Implementation Guide
V-239972
CAT II
The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish where the events occurred.
Cisco ASA VPN Security Technical Implementation Guide
V-215673
CAT II
The Cisco router must produce audit records containing information to establish where the events occurred.
Cisco IOS Router NDM Security Technical Implementation Guide
V-216569
CAT II
The Cisco router must be configured to produce audit records containing information to establish where the events occurred.
Cisco IOS Router RTR Security Technical Implementation Guide
V-220581
CAT II
The Cisco switch must produce audit records containing information to establish where the events occurred.
Cisco IOS Switch NDM Security Technical Implementation Guide
V-220437
CAT II
The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-215818
CAT II
The Cisco router must produce audit records containing information to establish where the events occurred.
Cisco IOS XE Router NDM Security Technical Implementation Guide
V-216659
CAT II
The Cisco router must be configured to produce audit records containing information to establish where the events occurred.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-220529
CAT II
The Cisco switch must produce audit records containing information to establish where the events occurred.
Cisco IOS XE Switch NDM Security Technical Implementation Guide
V-221004
CAT II
The Cisco switch must be configured to produce audit records containing information to establish where the events occurred.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-216528
CAT II
The Cisco router must produce audit records containing information to establish where the events occurred.
Cisco IOS XR Router NDM Security Technical Implementation Guide
V-216750
CAT II
The Cisco router must be configured to produce audit records containing information to establish where the events occurred.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-220484
CAT II
The Cisco switch must produce audit records containing information to establish where the events occurred.
Cisco NX OS Switch NDM Security Technical Implementation Guide
V-269469
CAT II
The audit package must be installed on AlmaLinux OS 9.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233044
CAT II
All audit records must identify where in the container platform the event occurred.
Container Platform Security Requirements Guide
V-233578
CAT II
PostgreSQL must produce audit records containing sufficient information to establish where the events occurred.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261868
CAT II
PostgreSQL must produce audit records containing sufficient information to establish where the events occurred.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-255541
CAT III
The DBN-6300 must produce audit records containing information to establish where the events occurred.
DBN-6300 NDM Security Technical Implementation Guide
V-206530
CAT II
The DBMS must produce audit records containing sufficient information to establish where the events occurred.
Database Security Requirements Guide
V-269774
CAT II
The Dell OS10 Switch must initiate session auditing upon startup.
Dell OS10 Switch NDM Security Technical Implementation Guide
V-235778
CAT II
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235779
CAT II
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205163
CAT II
The DNS server implementation must produce audit records containing information to establish where the events occurred.
Domain Name System (DNS) Security Requirements Guide
V-213572
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish where the events occurred.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259957
CAT II
The Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing where the connection occurred.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-259998
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing where (location) the connection originated.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259221
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish where the events occurred.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-266146
CAT II
The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266256
CAT II
The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.
F5 BIG-IP TMOS Firewall Security Technical Implementation Guide
V-266068
CAT II
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
F5 BIG-IP TMOS NDM Security Technical Implementation Guide
V-278385
CAT II
NGINX must provide audit records for DOD-defined auditable events.
F5 NGINX Security Technical Implementation Guide
V-206680
CAT II
The firewall must generate traffic log entries containing information to establish the location on the network where the events occurred.
Firewall Security Requirements Guide
V-234137
CAT II
The FortiGate firewall must generate traffic log entries containing information to establish the network location where the events occurred.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203606
CAT II
The operating system must produce audit records containing information to establish where the events occurred.
General Purpose Operating System Security Requirements Guide
V-217442
CAT III
The HP FlexFabric Switch must produce audit records containing information to establish where the events occurred.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-255267
CAT II
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-266910
CAT II
AOS must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.
HPE Aruba Networking AOS NDM Security Technical Implementation Guide
V-268245
CAT II
The HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.
HYCU Protege Security Technical Implementation Guide
V-215237
CAT II
AIX must produce audit records containing information to establish where the events occurred.
IBM AIX 7.x Security Technical Implementation Guide
V-256887
CAT II
Audit records content must contain valid information to allow for proper incident reporting.
IBM Hardware Management Console (HMC) Security Technical Implementation Guide
V-255782
CAT II
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255732
CAT II
The MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide
V-250325
CAT II
The WebSphere Liberty Server must log remote session and security activity.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255823
CAT II
The WebSphere Application Server audit event type filters must be configured.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223544
CAT II
IBM z/OS Required SMF data record types must be collected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223546
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223653
CAT II
IBM RACF SETROPTS LOGOPTIONS must be properly configured.
IBM z/OS RACF Security Technical Implementation Guide
V-223767
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS RACF Security Technical Implementation Guide
V-223769
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS RACF Security Technical Implementation Guide
V-223998
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS TSS Security Technical Implementation Guide
V-224001
CAT II
IBM z/OS must specify SMF data options to ensure appropriate activation.
IBM z/OS TSS Security Technical Implementation Guide
V-237899
CAT II
CA VM:Secure product must be installed and operating.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-34542
CAT II
The IDPS must produce audit records containing information to establish where the event was detected, including, at a minimum, network segment, destination address, and IDPS component which detected the event.
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide
V-206869
CAT II
The IDPS must produce audit records containing information to establish where the event was detected, including, at a minimum, network segment, destination address, and IDPS component which detected the event.
Intrusion Detection and Prevention Systems Security Requirements Guide
V-258601
CAT II
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-258587
CAT III
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-251017
CAT III
The Sentry must produce audit records containing information to establish where the events occurred.
Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide
V-251017
CAT III
The Sentry must produce audit records containing information to establish where the events occurred.
Ivanti Sentry 9.x ALG Security Technical Implementation Guide
V-213509
CAT II
JBoss must be configured to produce log records that establish which hosted application triggered the events.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253891
CAT II
The Juniper EX switch must be configured to produce audit records containing information to establish where the events occurred.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-253996
CAT II
The Juniper router must be configured to produce audit records containing information to establish where the events occurred.
Juniper EX Series Switches Router Security Technical Implementation Guide
V-217026
CAT II
The Juniper router must be configured to produce audit records containing information to establish where the events occurred.
Juniper Router RTR Security Technical Implementation Guide
V-242403
CAT II
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
Kubernetes Security Technical Implementation Guide
V-213814
CAT II
SQL Server must produce Trace or Audit records containing sufficient information to establish where the events occurred.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-205466
CAT II
The Mainframe Product must produce audit records containing information to establish where the events occurred.
Mainframe Product Security Requirements Guide
V-252896
CAT II
PowerShell Transcription must be enabled on Windows 10.
Microsoft Windows 10 Security Technical Implementation Guide
V-221160
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252134
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265907
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279334
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202032
CAT II
The network device must produce audit records containing information to establish where the events occurred.
Network Device Management Security Requirements Guide
V-254166
CAT II
Nutanix AOS must produce audit records containing information to establish where events occurred.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-219756
CAT II
The DBMS must produce audit records containing sufficient information to establish where the events occurred.
Oracle Database 11.2g Security Technical Implementation Guide
V-220272
CAT II
The DBMS must produce audit records containing sufficient information to establish where the events occurred.
Oracle Database 12c Security Technical Implementation Guide
V-221319
CAT II
OHS must have a log format defined for log records that allow the establishment of where within OHS the events occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221320
CAT II
OHS must have a SSL log format defined for log records that allow the establishment of where within OHS the events occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221321
CAT II
OHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of where within OHS the events occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221764
CAT II
The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.
Oracle Linux 7 Security Technical Implementation Guide
V-248519
CAT II
The OL 8 audit package must be installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271519
CAT II
OL 9 must have the audit package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271520
CAT II
OL 9 audit service must be enabled.
Oracle Linux 9 Security Technical Implementation Guide
V-271578
CAT II
OL 9 must label all offloaded audit logs before sending them to the central log server.
Oracle Linux 9 Security Technical Implementation Guide
V-235946
CAT III
Oracle WebLogic must produce audit records containing sufficient information to establish where the events occurred.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-253527
CAT II
Prisma Cloud Compute Defender must be deployed to containerization nodes that are to be monitored.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-214112
CAT II
PostgreSQL must produce audit records containing sufficient information to establish where the events occurred.
PostgreSQL 9.x Security Technical Implementation Guide
V-273788
CAT II
The RUCKUS ICX device must initiate session auditing upon startup.
RUCKUS ICX NDM Security Technical Implementation Guide
V-254555
CAT II
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-280993
CAT II
RHEL 10 must have the "audit" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280994
CAT II
RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281105
CAT II
RHEL 10 must label all off-loaded audit logs before sending them to the central log server.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258151
CAT II
RHEL 9 audit package must be installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258161
CAT II
RHEL 9 must label all offloaded audit logs before sending them to the central log server.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257522
CAT II
All audit records must generate the event results within OpenShift.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257522
CAT II
All audit records must generate the event results within OpenShift.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275452
CAT I
The Riverbed NetIM must enable and configure user audit logging.
Riverbed NetIM NDM Security Technical Implementation Guide
V-275677
CAT II
Ubuntu OS must have the "auditd" package installed.
Riverbed NetIM OS Security Technical Implementation Guide
V-275678
CAT II
Ubuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Riverbed NetIM OS Security Technical Implementation Guide
V-256072
CAT I
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
Riverbed NetProfiler Security Technical Implementation Guide
V-207120
CAT II
The router must be configured to produce audit records containing information to establish where the events occurred.
Router Security Requirements Guide
V-206719
CAT II
The SDN controller must be configured to produce audit records containing information to establish where the events occurred.
SDN Controller Security Requirements Guide
V-254092
CAT II
Innoslate must generate comprehensive audit records.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-261411
CAT II
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217191
CAT II
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216255
CAT II
Audit records must include where the events occurred.
Solaris 11 SPARC Security Technical Implementation Guide
V-216020
CAT II
Audit records must include where the events occurred.
Solaris 11 X86 Security Technical Implementation Guide
V-279177
CAT II
The Edge SWG must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-279255
CAT II
The Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94249
CAT II
Symantec ProxySG must produce audit records containing information to establish where the events occurred.
Symantec ProxySG ALG Security Technical Implementation Guide
V-242176
CAT II
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
Trend Micro TippingPoint IDPS Security Technical Implementation Guide
V-242259
CAT I
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-252973
CAT II
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282425
CAT II
TOSS 5 must label all offloaded audit logs before sending them to the central log server.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-234238
CAT II
The UEM Agent must record within each UEM Agent audit record the following information: -date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event.
Unified Endpoint Management Agent Security Requirements Guide
V-234330
CAT II
The UEM server must be configured to produce audit records containing information to establish where the events occurred.
Unified Endpoint Management Server Security Requirements Guide
V-240047
CAT II
HAProxy must log where events occurred.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240282
CAT II
vRA PostgreSQL database log file data must contain required data elements.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239779
CAT II
The vROps PostgreSQL DB must produce audit records containing sufficient information to establish where the events occurred.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-265612
CAT III
The NSX Distributed Firewall must generate traffic log entries that can be sent by the ESXi hosts to the central syslog.
VMware NSX 4.x Distributed Firewall Security Technical Implementation Guide
V-265362
CAT II
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
VMware NSX 4.x Tier-0 Gateway Firewall Security Technical Implementation Guide
V-265488
CAT II
The NSX Tier-1 Gateway firewall must generate traffic log entries.
VMware NSX 4.x Tier-1 Gateway Firewall Security Technical Implementation Guide
V-251727
CAT II
The NSX-T Distributed Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Distributed Firewall Security Technical Implementation Guide
V-251762
CAT III
The NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide
V-251737
CAT III
The NSX-T Tier-0 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier-0 Gateway Firewall Security Technical Implementation Guide
V-240222
CAT II
Lighttpd must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240755
CAT II
tc Server HORIZON must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240756
CAT II
tc Server VCO must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240757
CAT II
tc Server VCAC must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-241605
CAT II
tc Server UI must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241606
CAT II
tc Server CaSa must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241607
CAT II
tc Server API must produce log records containing sufficient information to establish where within the web server the events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256650
CAT II
VAMI must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256677
CAT II
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256710
CAT II
Lookup Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-256615
CAT II
Performance Charts must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-256487
CAT II
The Photon operating system must configure auditd to log to disk.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256592
CAT II
VMware Postgres log files must contain required fields.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256749
CAT II
The Security Token Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide
V-256782
CAT II
vSphere UI must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide
V-259006
CAT II
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide
V-259040
CAT II
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-259140
CAT II
The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-259074
CAT II
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-258808
CAT II
The Photon operating system must enable the auditd service.
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide
V-259171
CAT II
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258974
CAT II
The vCenter STS service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide
V-259107
CAT II
The vCenter UI service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide
V-207354
CAT II
The VMM must produce audit records containing information to establish where the events occurred.
Virtual Machine Manager Security Requirements Guide
V-207198
CAT II
The VPN Gateway must generate log records containing information to establish where the events occurred.
Virtual Private Network (VPN) Security Requirements Guide
V-206361
CAT II
The web server must produce log records containing sufficient information to establish where within the web server the events occurred.
Web Server Security Requirements Guide