STIGhub
STIGs
RMF Controls
Compare
← AU-3 — Content of Audit Records
CCI-000134
Definition
Ensure that audit records containing information that establishes the outcome of the event.
Parent Control
AU-3
Content of Audit Records
Audit and Accountability
Linked STIG Checks (178)
V-204650
CAT II
AAA Services configuration audit records must identify the outcome of the events.
AAA Services Security Requirements Guide
V-279034
CAT III
ColdFusion must produce log records containing information to establish what type of events occurred.
Adobe ColdFusion Security Technical Implementation Guide
V-274017
CAT II
Amazon Linux 2023 must have the audit package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268090
CAT II
The NixOS audit package must be installed.
Anduril NixOS Security Technical Implementation Guide
V-214232
CAT II
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214311
CAT II
The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222930
CAT II
AccessLogValve must be configured for each application context.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252464
CAT II
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257170
CAT II
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204932
CAT II
The ALG must produce audit records containing information to establish the outcome of the events.
Application Layer Gateway Security Requirements Guide
V-222476
CAT II
The application must produce audit records that contain information to establish the outcome of the events.
Application Security and Development Security Technical Implementation Guide
V-204725
CAT II
The application server must produce log records that contain sufficient information to establish the outcome of events.
Application Server Security Requirements Guide
V-237323
CAT I
The ArcGIS Server must provide audit record generation capability for DoD-defined auditable events within all application components.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-255962
CAT II
The Arista network device must be configured to capture all DOD auditable events.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-256008
CAT II
The Arista router must be configured to produce audit records containing information to establish where the events occurred.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-272371
CAT II
A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.
BIND 9.x Security Technical Implementation Guide
V-237354
CAT II
The CA API Gateway must produce audit records containing information to establish the outcome of the events.
CA API Gateway ALG Security Technical Implementation Guide
V-219225
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238298
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260590
CAT II
Ubuntu 22.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260591
CAT II
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270656
CAT II
Ubuntu 24.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270657
CAT II
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221912
CAT III
The Central Log Server must produce audit records that contain information to establish the outcome of the events.
Central Log Server Security Requirements Guide
V-271939
CAT II
The Cisco ACI must automatically audit account creation.
Cisco ACI NDM Security Technical Implementation Guide
V-272075
CAT III
The Cisco ACI must be configured to log all packets that have been dropped.
Cisco ACI Router Security Technical Implementation Guide
V-239877
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic.
Cisco ASA IPS Security Technical Implementation Guide
V-239909
CAT II
The Cisco ASA must be configured to produce audit records that contain information to establish the outcome of the event.
Cisco ASA NDM Security Technical Implementation Guide
V-239974
CAT II
The Cisco ASA remote access VPN server must be configured to produce log records containing information to establish the outcome of the events.
Cisco ASA VPN Security Technical Implementation Guide
V-216568
CAT III
The Cisco router must be configured to log all packets that have been dropped at interfaces via an ACL.
Cisco IOS Router RTR Security Technical Implementation Guide
V-220436
CAT III
The Cisco switch must be configured to log all packets that have been dropped at interfaces via an access control list (ACL).
Cisco IOS Switch RTR Security Technical Implementation Guide
V-216658
CAT III
The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-221003
CAT III
The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-216749
CAT III
The Cisco router must be configured to log all packets that have been dropped at interfaces via ACL.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-221086
CAT III
The Cisco switch must be configured to log all packets that have been dropped at interfaces via an ACL.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-269469
CAT II
The audit package must be installed on AlmaLinux OS 9.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233046
CAT II
All audit records must generate the event results within the container platform.
Container Platform Security Requirements Guide
V-233512
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261870
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-255543
CAT III
The DBN-6300 must produce audit records that contain information to establish the outcome of the event.
DBN-6300 NDM Security Technical Implementation Guide
V-206532
CAT II
The DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Database Security Requirements Guide
V-269774
CAT II
The Dell OS10 Switch must initiate session auditing upon startup.
Dell OS10 Switch NDM Security Technical Implementation Guide
V-269867
CAT III
The Dell OS10 Router must be configured to log all packets that have been dropped.
Dell OS10 Switch Router Security Technical Implementation Guide
V-235778
CAT II
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235779
CAT II
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205165
CAT II
The DNS server implementation must produce audit records that contain information to establish the outcome of the events.
Domain Name System (DNS) Security Requirements Guide
V-224136
CAT II
The EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213574
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259959
CAT II
The Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing the outcome of the connection.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-260000
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing the outcome (status) of the connection.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259223
CAT II
The EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-266146
CAT II
The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266256
CAT II
The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.
F5 BIG-IP TMOS Firewall Security Technical Implementation Guide
V-266068
CAT II
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
F5 BIG-IP TMOS NDM Security Technical Implementation Guide
V-278385
CAT II
NGINX must provide audit records for DOD-defined auditable events.
F5 NGINX Security Technical Implementation Guide
V-206682
CAT II
The firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
Firewall Security Requirements Guide
V-234139
CAT II
The FortiGate firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203608
CAT II
The operating system must produce audit records containing information to establish the outcome of the events.
General Purpose Operating System Security Requirements Guide
V-217444
CAT III
The HP FlexFabric Switch must produce audit records that contain information to establish the outcome of the event.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-255267
CAT II
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-268245
CAT II
The HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.
HYCU Protege Security Technical Implementation Guide
V-215239
CAT II
AIX must produce audit records containing information to establish the outcome of the events.
IBM AIX 7.x Security Technical Implementation Guide
V-213679
CAT II
DB2 must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-256887
CAT II
Audit records content must contain valid information to allow for proper incident reporting.
IBM Hardware Management Console (HMC) Security Technical Implementation Guide
V-255782
CAT II
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-250325
CAT II
The WebSphere Liberty Server must log remote session and security activity.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255823
CAT II
The WebSphere Application Server audit event type filters must be configured.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223544
CAT II
IBM z/OS Required SMF data record types must be collected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223546
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223653
CAT II
IBM RACF SETROPTS LOGOPTIONS must be properly configured.
IBM z/OS RACF Security Technical Implementation Guide
V-223767
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS RACF Security Technical Implementation Guide
V-223769
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS RACF Security Technical Implementation Guide
V-223998
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS TSS Security Technical Implementation Guide
V-224001
CAT II
IBM z/OS must specify SMF data options to ensure appropriate activation.
IBM z/OS TSS Security Technical Implementation Guide
V-237899
CAT II
CA VM:Secure product must be installed and operating.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-34544
CAT II
The IDPS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic.
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide
V-206871
CAT II
The IDPS must produce audit records containing information to establish the outcome of events associated with detected harmful or potentially harmful traffic, including, at a minimum, capturing all associated communications traffic.
Intrusion Detection and Prevention Systems Security Requirements Guide
V-258601
CAT II
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-258587
CAT III
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-251019
CAT III
The Sentry must produce audit records containing information to establish the outcome of the events.
Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide
V-251019
CAT III
The Sentry must produce audit records containing information to establish the outcome of the events.
Ivanti Sentry 9.x ALG Security Technical Implementation Guide
V-213511
CAT II
The application server must produce log records that contain sufficient information to establish the outcome of events.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253893
CAT II
The Juniper EX switch must be configured to produce audit records that contain information to establish the outcome of the event.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-253998
CAT III
The Juniper router must be configured to log all packets that have been dropped.
Juniper EX Series Switches Router Security Technical Implementation Guide
V-217025
CAT III
The Juniper router must be configured to log all packets that have been dropped.
Juniper Router RTR Security Technical Implementation Guide
V-242403
CAT II
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
Kubernetes Security Technical Implementation Guide
V-213816
CAT II
SQL Server must produce Trace or Audit records containing sufficient information to establish the outcome (success or failure) of the events.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-205468
CAT II
The Mainframe Product must produce audit records containing information to establish the outcome of the events.
Mainframe Product Security Requirements Guide
V-218788
CAT II
The IIS 10.0 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 web server events.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-218741
CAT II
The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events.
Microsoft IIS 10.0 Site Security Technical Implementation Guide
V-252896
CAT II
PowerShell Transcription must be enabled on Windows 10.
Microsoft Windows 10 Security Technical Implementation Guide
V-253415
CAT II
PowerShell Transcription must be enabled on Windows 11.
Microsoft Windows 11 Security Technical Implementation Guide
V-257502
CAT II
Windows Server 2016 must have PowerShell Transcription enabled.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-257503
CAT II
Windows Server 2019 must have PowerShell Transcription enabled.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254384
CAT II
Windows Server 2022 must have PowerShell Transcription enabled.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-221160
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252134
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265907
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279334
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202034
CAT II
The network device must produce audit records that contain information to establish the outcome of the event.
Network Device Management Security Requirements Guide
V-254168
CAT II
Nutanix AOS must produce audit records containing information to establish the outcome of events.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-219758
CAT II
The DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Oracle Database 11.2g Security Technical Implementation Guide
V-220274
CAT II
The DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
Oracle Database 12c Security Technical Implementation Guide
V-221328
CAT II
OHS must have a log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221329
CAT II
OHS must have a SSL log format defined to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221330
CAT II
OHS must have a log file defined for each site/virtual host to produce log records that contain sufficient information to establish the outcome (success or failure) of events.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-248519
CAT II
The OL 8 audit package must be installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271519
CAT II
OL 9 must have the audit package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271520
CAT II
OL 9 audit service must be enabled.
Oracle Linux 9 Security Technical Implementation Guide
V-235948
CAT III
Oracle WebLogic must produce audit records that contain sufficient information to establish the outcome (success or failure) of application server and application events.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-207690
CAT II
The Palo Alto Networks security platform must capture traffic of detected/dropped malicious code.
Palo Alto Networks IDPS Security Technical Implementation Guide
V-253528
CAT II
Prisma Cloud Compute must be configured for forensic data collection.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-214049
CAT II
PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
PostgreSQL 9.x Security Technical Implementation Guide
V-273788
CAT II
The RUCKUS ICX device must initiate session auditing upon startup.
RUCKUS ICX NDM Security Technical Implementation Guide
V-273594
CAT III
The RUCKUS ICX router must be configured to log all packets that have been dropped.
RUCKUS ICX Router Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-254555
CAT II
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-280993
CAT II
RHEL 10 must have the "audit" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280994
CAT II
RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258151
CAT II
RHEL 9 audit package must be installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257522
CAT II
All audit records must generate the event results within OpenShift.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275452
CAT I
The Riverbed NetIM must enable and configure user audit logging.
Riverbed NetIM NDM Security Technical Implementation Guide
V-275677
CAT II
Ubuntu OS must have the "auditd" package installed.
Riverbed NetIM OS Security Technical Implementation Guide
V-275678
CAT II
Ubuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Riverbed NetIM OS Security Technical Implementation Guide
V-256072
CAT I
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
Riverbed NetProfiler Security Technical Implementation Guide
V-207122
CAT III
The router must be configured to log all packets that have been dropped.
Router Security Requirements Guide
V-206721
CAT II
The SDN controller must be configured to produce audit records containing information to establish the outcome of the events.
SDN Controller Security Requirements Guide
V-261411
CAT II
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217191
CAT II
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-1011
CAT III
Inetd or xinetd logging/tracing must be enabled.
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide
V-216257
CAT II
Audit records must include the outcome (success or failure) of the events that occurred.
Solaris 11 SPARC Security Technical Implementation Guide
V-216022
CAT II
Audit records must include the outcome (success or failure) of the events that occurred.
Solaris 11 X86 Security Technical Implementation Guide
V-279177
CAT II
The Edge SWG must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-279255
CAT II
The Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94253
CAT II
Symantec ProxySG must produce audit records containing information to establish the outcome of the events.
Symantec ProxySG ALG Security Technical Implementation Guide
V-242176
CAT II
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
Trend Micro TippingPoint IDPS Security Technical Implementation Guide
V-242259
CAT I
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-252973
CAT II
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-234332
CAT II
The UEM server must be configured to produce audit records that contain information to establish the outcome of the events.
Unified Endpoint Management Server Security Requirements Guide
V-240049
CAT II
HAProxy must log the outcome of events.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240284
CAT II
vRA PostgreSQL database log file data must contain required data elements.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239781
CAT II
The vROps PostgreSQL DB must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-265612
CAT III
The NSX Distributed Firewall must generate traffic log entries that can be sent by the ESXi hosts to the central syslog.
VMware NSX 4.x Distributed Firewall Security Technical Implementation Guide
V-265362
CAT II
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
VMware NSX 4.x Tier-0 Gateway Firewall Security Technical Implementation Guide
V-265488
CAT II
The NSX Tier-1 Gateway firewall must generate traffic log entries.
VMware NSX 4.x Tier-1 Gateway Firewall Security Technical Implementation Guide
V-251762
CAT III
The NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide
V-251737
CAT III
The NSX-T Tier-0 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier-0 Gateway Firewall Security Technical Implementation Guide
V-240224
CAT II
Lighttpd must produce log records containing sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240764
CAT II
tc Server HORIZON must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240765
CAT II
tc Server VCO must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240766
CAT II
tc Server VCAC must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-241614
CAT II
tc Server UI must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241615
CAT II
tc Server CaSa must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241616
CAT II
tc Server API must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256650
CAT II
VAMI must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256677
CAT II
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256710
CAT II
Lookup Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-256615
CAT II
Performance Charts must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-256487
CAT II
The Photon operating system must configure auditd to log to disk.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256592
CAT II
VMware Postgres log files must contain required fields.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256749
CAT II
The Security Token Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide
V-256782
CAT II
vSphere UI must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide
V-259006
CAT II
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide
V-259040
CAT II
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-259140
CAT II
The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-259074
CAT II
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-258808
CAT II
The Photon operating system must enable the auditd service.
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide
V-259171
CAT II
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258974
CAT II
The vCenter STS service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide
V-259107
CAT II
The vCenter UI service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide
V-207356
CAT II
The VMM must produce audit records containing information to establish the outcome of the events.
Virtual Machine Manager Security Requirements Guide
V-207200
CAT II
The VPN Gateway must produce log records containing information to establish the outcome of the events.
Virtual Private Network (VPN) Security Requirements Guide
V-206364
CAT II
The web server must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
Web Server Security Requirements Guide