STIGhub
STIGs
RMF Controls
Compare
← AU-3 — Content of Audit Records
CCI-000133
Definition
Ensure that audit records containing information that establishes the source of the event.
Parent Control
AU-3
Content of Audit Records
Audit and Accountability
Linked STIG Checks (191)
V-237033
CAT III
The A10 Networks ADC, when used to load balance web applications, must enable external logging for accessing Web Application Firewall data event messages.
A10 Networks ADC ALG Security Technical Implementation Guide
V-255591
CAT III
The A10 Networks ADC must produce audit log records containing information (FQDN, unique hostname, management or loopback IP address) to establish the source of events.
A10 Networks ADC NDM Security Technical Implementation Guide
V-204649
CAT II
AAA Services configuration audit records must identify the source of the events.
AAA Services Security Requirements Guide
V-279034
CAT III
ColdFusion must produce log records containing information to establish what type of events occurred.
Adobe ColdFusion Security Technical Implementation Guide
V-274017
CAT II
Amazon Linux 2023 must have the audit package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268090
CAT II
The NixOS audit package must be installed.
Anduril NixOS Security Technical Implementation Guide
V-214232
CAT II
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214233
CAT II
An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214311
CAT II
The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214312
CAT II
An Apache web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222930
CAT II
AccessLogValve must be configured for each application context.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252464
CAT II
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257170
CAT II
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204931
CAT II
The ALG must produce audit records containing information to establish the source of the events.
Application Layer Gateway Security Requirements Guide
V-274537
CAT II
All defined API elements must be documented.
Application Programming Interface (API) Security Requirements Guide
V-222475
CAT II
When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.
Application Security and Development Security Technical Implementation Guide
V-204724
CAT II
The application server must produce log records containing sufficient information to establish the sources of the events.
Application Server Security Requirements Guide
V-237323
CAT I
The ArcGIS Server must provide audit record generation capability for DoD-defined auditable events within all application components.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-255962
CAT II
The Arista network device must be configured to capture all DOD auditable events.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-256008
CAT II
The Arista router must be configured to produce audit records containing information to establish where the events occurred.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-272371
CAT II
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
BIND 9.x Security Technical Implementation Guide
V-237353
CAT II
The CA API Gateway must produce audit records containing information to establish the source of the events.
CA API Gateway ALG Security Technical Implementation Guide
V-219225
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238298
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260590
CAT II
Ubuntu 22.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260591
CAT II
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270656
CAT II
Ubuntu 24.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270657
CAT II
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221911
CAT III
The Central Log Server must produce audit records containing information to establish the source of the events.
Central Log Server Security Requirements Guide
V-271939
CAT II
The Cisco ACI must automatically audit account creation.
Cisco ACI NDM Security Technical Implementation Guide
V-239876
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish the source of the event.
Cisco ASA IPS Security Technical Implementation Guide
V-239908
CAT II
The Cisco ASA must be configured to produce audit log records containing information to establish the source of events.
Cisco ASA NDM Security Technical Implementation Guide
V-239973
CAT III
The Cisco ASA remote access VPN server must be configured to generate log records containing information to establish the source of the events.
Cisco ASA VPN Security Technical Implementation Guide
V-216570
CAT II
The Cisco router must be configured to produce audit records containing information to establish the source of the events.
Cisco IOS Router RTR Security Technical Implementation Guide
V-220438
CAT II
The Cisco switch must be configured to produce audit records containing information to establish the source of the events.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-216660
CAT II
The Cisco router must be configured to produce audit records containing information to establish the source of the events.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-221005
CAT II
The Cisco switch must be configured to produce audit records containing information to establish the source of the events.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-216751
CAT II
The Cisco router must be configured to produce audit records containing information to establish the source of the events.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-269469
CAT II
The audit package must be installed on AlmaLinux OS 9.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233045
CAT II
All audit records must identify the source of the event within the container platform.
Container Platform Security Requirements Guide
V-233591
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the sources (origins) of the events.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261869
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the sources (origins) of the events.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-255542
CAT III
The DBN-6300 must produce audit log records containing information to establish the source of events.
DBN-6300 NDM Security Technical Implementation Guide
V-206531
CAT II
The DBMS must produce audit records containing sufficient information to establish the sources (origins) of the events.
Database Security Requirements Guide
V-269774
CAT II
The Dell OS10 Switch must initiate session auditing upon startup.
Dell OS10 Switch NDM Security Technical Implementation Guide
V-235778
CAT II
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235779
CAT II
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205164
CAT II
The DNS server implementation must produce audit records containing information to establish the source of the events.
Domain Name System (DNS) Security Requirements Guide
V-213573
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the sources (origins) of the events.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259958
CAT II
The Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing the source of the connection.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-259999
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing the identity of the initiator of the call.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259222
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the sources (origins) of the events.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-266146
CAT II
The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266256
CAT II
The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.
F5 BIG-IP TMOS Firewall Security Technical Implementation Guide
V-266068
CAT II
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
F5 BIG-IP TMOS NDM Security Technical Implementation Guide
V-278385
CAT II
NGINX must provide audit records for DOD-defined auditable events.
F5 NGINX Security Technical Implementation Guide
V-206681
CAT III
The firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
Firewall Security Requirements Guide
V-234138
CAT III
The FortiGate firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203607
CAT II
The operating system must produce audit records containing information to establish the source of the events.
General Purpose Operating System Security Requirements Guide
V-217443
CAT III
The HP FlexFabric Switch must produce audit log records containing information to establish the source of events.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-255267
CAT II
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-268245
CAT II
The HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.
HYCU Protege Security Technical Implementation Guide
V-215238
CAT II
AIX must produce audit records containing information to establish the source and the identity of any individual or process associated with an event.
IBM AIX 7.x Security Technical Implementation Guide
V-256887
CAT II
Audit records content must contain valid information to allow for proper incident reporting.
IBM Hardware Management Console (HMC) Security Technical Implementation Guide
V-255782
CAT II
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255732
CAT II
The MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide
V-250325
CAT II
The WebSphere Liberty Server must log remote session and security activity.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255823
CAT II
The WebSphere Application Server audit event type filters must be configured.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223544
CAT II
IBM z/OS Required SMF data record types must be collected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223546
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223653
CAT II
IBM RACF SETROPTS LOGOPTIONS must be properly configured.
IBM z/OS RACF Security Technical Implementation Guide
V-223767
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS RACF Security Technical Implementation Guide
V-223769
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS RACF Security Technical Implementation Guide
V-223998
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS TSS Security Technical Implementation Guide
V-224001
CAT II
IBM z/OS must specify SMF data options to ensure appropriate activation.
IBM z/OS TSS Security Technical Implementation Guide
V-237899
CAT II
CA VM:Secure product must be installed and operating.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-34543
CAT II
The IDPS must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address.
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide
V-206870
CAT II
The IDPS must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address.
Intrusion Detection and Prevention Systems Security Requirements Guide
V-258601
CAT II
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-258587
CAT III
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-251018
CAT III
The Sentry must produce audit records containing information to establish the source of the events.
Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide
V-251018
CAT III
The Sentry must produce audit records containing information to establish the source of the events.
Ivanti Sentry 9.x ALG Security Technical Implementation Guide
V-213510
CAT II
JBoss must be configured to record the IP address and port information used by management interface network traffic.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253892
CAT II
The Juniper EX switch must be configured to produce audit log records containing information to establish the source of events.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-253997
CAT II
The Juniper router must be configured to produce audit records containing information to establish the source of the events.
Juniper EX Series Switches Router Security Technical Implementation Guide
V-217027
CAT II
The Juniper router must be configured to produce audit records containing information to establish the source of the events.
Juniper Router RTR Security Technical Implementation Guide
V-242403
CAT II
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
Kubernetes Security Technical Implementation Guide
V-213815
CAT II
SQL Server must produce Trace or Audit records containing sufficient information to establish the sources (origins) of the events.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-205467
CAT II
The Mainframe Product must produce audit records containing information to establish the source of the events.
Mainframe Product Security Requirements Guide
V-228360
CAT III
Exchange Circular Logging must be disabled.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-228361
CAT II
Exchange Email Subject Line logging must be disabled.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-228362
CAT II
Exchange Message Tracking Logging must be enabled.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259583
CAT II
Exchange message tracking logging must be enabled.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259656
CAT II
Exchange email subject line logging must be disabled.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-259657
CAT II
Exchange message tracking logging must be enabled.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-259658
CAT III
Exchange circular logging must be disabled.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-218740
CAT II
An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.
Microsoft IIS 10.0 Site Security Technical Implementation Guide
V-221160
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252134
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265907
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279334
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202033
CAT II
The network device must produce audit log records containing information to establish the source of events.
Network Device Management Security Requirements Guide
V-254167
CAT II
Nutanix AOS must produce audit records containing information to establish the source of events.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-219757
CAT II
The DBMS must produce audit records containing sufficient information to establish the sources (origins) of the events.
Oracle Database 11.2g Security Technical Implementation Guide
V-220273
CAT II
The DBMS must produce audit records containing sufficient information to establish the sources (origins) of the events.
Oracle Database 12c Security Technical Implementation Guide
V-221322
CAT II
OHS must have a log format defined for log records that allow the establishment of the source of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221323
CAT II
OHS must have a SSL log format defined for log records that allow the establishment of the source of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221324
CAT II
OHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of the source of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221325
CAT II
OHS, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221326
CAT II
OHS, behind a load balancer or proxy server, must have the SSL log format set correctly to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221327
CAT II
OHS, behind a load balancer or proxy server, must have a log file defined for each site/virtual host to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-248519
CAT II
The OL 8 audit package must be installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271519
CAT II
OL 9 must have the audit package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271520
CAT II
OL 9 audit service must be enabled.
Oracle Linux 9 Security Technical Implementation Guide
V-235947
CAT III
Oracle WebLogic must produce audit records containing sufficient information to establish the sources of the events.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-228836
CAT III
The Palo Alto Networks security platform must log violations of security policies.
Palo Alto Networks ALG Security Technical Implementation Guide
V-207689
CAT II
The Palo Alto Networks security platform must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address.
Palo Alto Networks IDPS Security Technical Implementation Guide
V-228643
CAT III
The Palo Alto Networks security platform must produce audit log records containing information (FQDN, unique hostname, management IP address) to establish the source of events.
Palo Alto Networks NDM Security Technical Implementation Guide
V-214125
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the sources (origins) of the events.
PostgreSQL 9.x Security Technical Implementation Guide
V-273788
CAT II
The RUCKUS ICX device must initiate session auditing upon startup.
RUCKUS ICX NDM Security Technical Implementation Guide
V-252846
CAT II
Rancher MCM must allocate audit record storage and generate audit records associated with events, users, and groups.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-254555
CAT II
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-280984
CAT II
RHEL 10 must have the rsyslog service set to active.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280991
CAT II
RHEL 10 must use cron logging.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280993
CAT II
RHEL 10 must have the "audit" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280994
CAT II
RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258151
CAT II
RHEL 9 audit package must be installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257522
CAT II
All audit records must generate the event results within OpenShift.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275452
CAT I
The Riverbed NetIM must enable and configure user audit logging.
Riverbed NetIM NDM Security Technical Implementation Guide
V-275677
CAT II
Ubuntu OS must have the "auditd" package installed.
Riverbed NetIM OS Security Technical Implementation Guide
V-275678
CAT II
Ubuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Riverbed NetIM OS Security Technical Implementation Guide
V-256072
CAT I
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
Riverbed NetProfiler Security Technical Implementation Guide
V-207121
CAT II
The router must be configured to produce audit records containing information to establish the source of the events.
Router Security Requirements Guide
V-206720
CAT II
The SDN controller must be configured to produce audit records containing information to establish the source of the events.
SDN Controller Security Requirements Guide
V-261411
CAT II
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217191
CAT II
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216256
CAT II
Audit records must include the sources of the events that occurred.
Solaris 11 SPARC Security Technical Implementation Guide
V-216021
CAT II
Audit records must include the sources of the events that occurred.
Solaris 11 X86 Security Technical Implementation Guide
V-279177
CAT II
The Edge SWG must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-279255
CAT II
The Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94251
CAT II
Symantec ProxySG must produce audit records containing information to establish the source of the events.
Symantec ProxySG ALG Security Technical Implementation Guide
V-242176
CAT II
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
Trend Micro TippingPoint IDPS Security Technical Implementation Guide
V-252973
CAT II
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-234331
CAT II
The UEM server must be configured to produce audit records containing information to establish the source of the events.
Unified Endpoint Management Server Security Requirements Guide
V-240048
CAT II
HAProxy must log the source of events.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240283
CAT II
vRA PostgreSQL database log file data must contain required data elements.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239780
CAT II
The vROps PostgreSQL DB must produce audit records containing sufficient information to establish the sources (origins) of the events.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-265612
CAT III
The NSX Distributed Firewall must generate traffic log entries that can be sent by the ESXi hosts to the central syslog.
VMware NSX 4.x Distributed Firewall Security Technical Implementation Guide
V-265362
CAT II
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
VMware NSX 4.x Tier-0 Gateway Firewall Security Technical Implementation Guide
V-265488
CAT II
The NSX Tier-1 Gateway firewall must generate traffic log entries.
VMware NSX 4.x Tier-1 Gateway Firewall Security Technical Implementation Guide
V-251727
CAT II
The NSX-T Distributed Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Distributed Firewall Security Technical Implementation Guide
V-251762
CAT III
The NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide
V-251737
CAT III
The NSX-T Tier-0 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier-0 Gateway Firewall Security Technical Implementation Guide
V-240223
CAT II
Lighttpd must produce log records containing sufficient information to establish the source of events.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240758
CAT II
tc Server HORIZON must produce log records containing sufficient information to establish the source of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240759
CAT II
tc Server VCO must produce log records containing sufficient information to establish the source of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240760
CAT II
tc Server VCAC must produce log records containing sufficient information to establish the source of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240761
CAT II
tc Server HORIZON must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240762
CAT II
tc Server VCO must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240763
CAT II
tc Server VCAC must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-241608
CAT II
tc Server UI must produce log records containing sufficient information to establish the source of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241609
CAT II
tc Server CaSa must produce log records containing sufficient information to establish the source of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241610
CAT II
tc Server API must produce log records containing sufficient information to establish the source of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241611
CAT II
tc Server UI must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241612
CAT II
tc Server CaSa must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241613
CAT II
tc Server API must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256650
CAT II
VAMI must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256677
CAT II
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256710
CAT II
Lookup Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-256615
CAT II
Performance Charts must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-256487
CAT II
The Photon operating system must configure auditd to log to disk.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256592
CAT II
VMware Postgres log files must contain required fields.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256749
CAT II
The Security Token Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide
V-256782
CAT II
vSphere UI must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide
V-259006
CAT II
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide
V-259040
CAT II
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-259140
CAT II
The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-259074
CAT II
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-258808
CAT II
The Photon operating system must enable the auditd service.
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide
V-259171
CAT II
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258974
CAT II
The vCenter STS service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide
V-259107
CAT II
The vCenter UI service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide
V-207355
CAT II
The VMM must produce audit records containing information to establish the source of the events.
Virtual Machine Manager Security Requirements Guide
V-207199
CAT III
The VPN Gateway must generate log records containing information to establish the source of the events.
Virtual Private Network (VPN) Security Requirements Guide
V-206362
CAT II
The web server must produce log records containing sufficient information to establish the source of events.
Web Server Security Requirements Guide
V-206363
CAT II
A web server, behind a load balancer or proxy server, must produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
Web Server Security Requirements Guide