STIGhub
STIGs
RMF Controls
Compare
← AU-9 — Protection of Audit Information
CCI-000162
Definition
Protect audit information from unauthorized access.
Parent Control
AU-9
Protection of Audit Information
Audit and Accountability
Linked STIG Checks (200)
V-279036
CAT II
The ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.
Adobe ColdFusion Security Technical Implementation Guide
V-279055
CAT I
ColdFusion must be using an enterprise solution for authentication.
Adobe ColdFusion Security Technical Implementation Guide
V-274108
CAT II
Amazon Linux 2023 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Amazon Linux 2023 Security Technical Implementation Guide
V-274109
CAT II
Amazon Linux 2023 audit log directory must be owned by root to prevent unauthorized read access.
Amazon Linux 2023 Security Technical Implementation Guide
V-274110
CAT II
Amazon Linux 2023 audit logs file must have mode "0600" or less permissive to prevent unauthorized access to the audit log.
Amazon Linux 2023 Security Technical Implementation Guide
V-274187
CAT II
Amazon Linux 2023 audit system must protect logon user identifiers (UIDs) from unauthorized change.
Amazon Linux 2023 Security Technical Implementation Guide
V-268110
CAT II
NixOS audit daemon must generate logs that are group-owned by root.
Anduril NixOS Security Technical Implementation Guide
V-268111
CAT II
NixOS audit directory and logs must be owned by root to prevent unauthorized read access.
Anduril NixOS Security Technical Implementation Guide
V-268112
CAT II
NixOS audit directory and logs must be group-owned by root to prevent unauthorized read access.
Anduril NixOS Security Technical Implementation Guide
V-268113
CAT II
NixOS audit log directory must have a mode of 0700 or less permissive.
Anduril NixOS Security Technical Implementation Guide
V-268114
CAT II
NixOS audit logs must have a mode of 0600 or less permissive.
Anduril NixOS Security Technical Implementation Guide
V-268115
CAT II
NixOS journald directory and logs must be owned by root to prevent unauthorized read access.
Anduril NixOS Security Technical Implementation Guide
V-268116
CAT II
NixOS journald directory and logs must be group-owned by systemd-journald to prevent unauthorized read access.
Anduril NixOS Security Technical Implementation Guide
V-268117
CAT II
NixOS systemd-journald directory must have a mode of 2755 or less permissive.
Anduril NixOS Security Technical Implementation Guide
V-268118
CAT II
NixOS systemd-journald logs must have a mode of 0640 or less permissive.
Anduril NixOS Security Technical Implementation Guide
V-214235
CAT II
The Apache web server log files must only be accessible by privileged users.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214314
CAT II
The Apache web server log files must only be accessible by privileged users.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222943
CAT II
$CATALINA_BASE/logs folder permissions must be set to 750.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222944
CAT II
Files in the $CATALINA_BASE/logs/ folder must have their permissions set to 640.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252452
CAT II
The macOS system must be configured so that log files must not contain access control lists (ACLs).
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252453
CAT II
The macOS system must be configured so that log folders must not contain access control lists (ACLs).
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252466
CAT II
The macOS system must be configured with audit log files owned by root.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252467
CAT II
The macOS system must be configured with audit log folders owned by root.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252468
CAT II
The macOS system must be configured with audit log files group-owned by wheel.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252469
CAT II
The macOS system must be configured with audit log folders group-owned by wheel.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252470
CAT II
The macOS system must be configured with audit log files set to mode 440 or less permissive.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-252471
CAT II
The macOS system must be configured with audit log folders set to mode 700 or less permissive.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257158
CAT II
The macOS system must be configured so that log files do not contain access control lists (ACLs).
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257159
CAT II
The macOS system must be configured so that log folders do not contain access control lists (ACLs).
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257172
CAT II
The macOS system must be configured with audit log files owned by root.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257173
CAT II
The macOS system must be configured with audit log folders owned by root.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257174
CAT II
The macOS system must be configured with audit log files group-owned by wheel.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257175
CAT II
The macOS system must be configured with audit log folders group-owned by wheel.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257176
CAT II
The macOS system must be configured with audit log files set to mode 440 or less permissive.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-257177
CAT II
The macOS system must be configured with audit log folders set to mode 700 or less permissive.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-259432
CAT II
The macOS system must configure audit log files to not contain access control lists.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259433
CAT II
The macOS system must configure audit log folders to not contain access control lists.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259456
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259457
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259458
CAT II
The macOS system must configure audit log files group to wheel.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259459
CAT II
The macOS system must configure audit log folders group to wheel.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259460
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259461
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259462
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259463
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259464
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259465
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259473
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259474
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259475
CAT II
The macOS system must configure audit_control to mode 440 or less permissive.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-259476
CAT II
The macOS system must configure audit_control to not contain access control lists.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-268432
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268433
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268456
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268457
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268458
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268459
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268460
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268461
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268462
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268463
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268464
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268465
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268473
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268474
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268475
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-269095
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277040
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277041
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277063
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277064
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277065
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277066
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277067
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277068
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277069
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277070
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277071
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277072
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277080
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277081
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277082
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277083
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204936
CAT II
The ALG must protect audit information from unauthorized read access.
Application Layer Gateway Security Requirements Guide
V-222500
CAT II
The application must protect audit information from any type of unauthorized read access.
Application Security and Development Security Technical Implementation Guide
V-204732
CAT II
The application server must protect log information from any type of unauthorized read access.
Application Server Security Requirements Guide
V-237324
CAT II
The ArcGIS Server must protect audit information from any type of unauthorized read access, modification or deletion.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-79003
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from any type of unauthorized read access.
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-254706
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from any type of unauthorized read access.
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-237356
CAT II
The CA API Gateway must protect audit information from unauthorized read access.
CA API Gateway ALG Security Technical Implementation Guide
V-219228
CAT II
The Ubuntu operating system must be configured so that audit log files cannot be read or write-accessible by unauthorized users.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219229
CAT II
The Ubuntu operating system must permit only authorized accounts ownership of the audit log files.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219230
CAT II
The Ubuntu operating system must permit only authorized groups to own the audit log files.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238245
CAT II
The Ubuntu operating system must be configured so that audit log files are not read or write-accessible by unauthorized users.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238246
CAT II
The Ubuntu operating system must be configured to permit only authorized users ownership of the audit log files.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238247
CAT II
The Ubuntu operating system must permit only authorized groups ownership of the audit log files.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260597
CAT II
Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by unauthorized users.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260598
CAT II
Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260599
CAT II
Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270827
CAT II
Ubuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible by unauthorized users.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270828
CAT II
Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270829
CAT II
Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221914
CAT II
The Central Log Server must protect audit information from any type of unauthorized read access.
Central Log Server Security Requirements Guide
V-269536
CAT II
AlmaLinux OS 9 audit log directory must be owned by root to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269537
CAT II
AlmaLinux OS 9 audit log directory must have 0700 permissions to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269538
CAT II
AlmaLinux OS 9 audit logs must be owned by the root group to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269539
CAT II
AlmaLinux OS 9 audit logs must be owned by root to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269540
CAT II
AlmaLinux OS 9 audit logs must have 0600 permissions to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233056
CAT II
The container platform must protect audit information from any type of unauthorized read access.
Container Platform Security Requirements Guide
V-233549
CAT II
The audit information produced by PostgreSQL must be protected from unauthorized read access.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261875
CAT II
The audit information produced by PostgreSQL must be protected from unauthorized read access.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206538
CAT II
The audit information produced by the DBMS must be protected from unauthorized read access.
Database Security Requirements Guide
V-224148
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213579
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-260003
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must protect session (call) records from unauthorized read access.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259228
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-228985
CAT II
The BIG-IP appliance must be configured to protect audit information from any type of unauthorized read access.
F5 BIG-IP Device Management Security Technical Implementation Guide
V-215749
CAT II
The BIG-IP Core implementation must be configured to protect audit information from unauthorized read access.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-278388
CAT II
NGINX must protect audit information from unauthorized access.
F5 NGINX Security Technical Implementation Guide
V-234141
CAT II
The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203616
CAT II
The operating system must protect audit information from unauthorized read access.
General Purpose Operating System Security Requirements Guide
V-230165
CAT II
The HP FlexFabric Switch must protect audit information from any type of unauthorized read access.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-215243
CAT II
Audit logs on the AIX system must be owned by root.
IBM AIX 7.x Security Technical Implementation Guide
V-215244
CAT II
Audit logs on the AIX system must be group-owned by system.
IBM AIX 7.x Security Technical Implementation Guide
V-215245
CAT II
Audit logs on the AIX system must be set to 660 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-252559
CAT II
The IBM Aspera Console must protect audit information from unauthorized read access.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252592
CAT II
IBM Aspera Faspex must protect audit information from unauthorized modification.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252609
CAT II
IBM Aspera Shares must protect audit information from unauthorized deletion.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-213682
CAT II
The audit information produced by DB2 must be protected from unauthorized read access.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-65211
CAT II
The DataPower Gateway must protect audit information from unauthorized read access.
IBM DataPower ALG Security Technical Implementation Guide
V-65075
CAT II
The DataPower Gateway must protect audit information from any type of unauthorized read access.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-250325
CAT II
The WebSphere Liberty Server must log remote session and security activity.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-250330
CAT II
The WebSphere Liberty Server must be configured to encrypt log information.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255848
CAT III
The WebSphere Application Server must be configured to protect log information from any type of unauthorized read access.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223554
CAT II
IBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223701
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS RACF Security Technical Implementation Guide
V-223881
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS TSS Security Technical Implementation Guide
V-237907
CAT II
CA VM:Secure product AUDIT file must be restricted to authorized personnel.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-213513
CAT II
File permissions must be configured to protect log information from any type of unauthorized read access.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-213820
CAT II
The audit information produced by SQL Server must be protected from unauthorized read access.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213944
CAT II
The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205477
CAT II
The Mainframe Product must protect audit information from any type of unauthorized read access.
Mainframe Product Security Requirements Guide
V-253679
CAT II
The audit information produced by MariaDB must be protected from unauthorized read access.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220349
CAT II
The audit information produced by MarkLogic Server must be protected from unauthorized read access.
MarkLogic Server v9 Security Technical Implementation Guide
V-255330
CAT II
The audit information produced by Azure SQL Database must be protected from unauthorized read access.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276298
CAT II
The audit information produced by Azure SQL Managed Instance must be protected from unauthorized access.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-221211
CAT II
Exchange Audit data must be protected against unauthorized access (read access).
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-228365
CAT II
Exchange must protect audit data against unauthorized read access.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259585
CAT II
Exchange audit data must be protected against unauthorized access (read access).
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259660
CAT II
Exchange must protect audit data against unauthorized read access.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-271282
CAT II
The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-220782
CAT II
Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220783
CAT II
Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220784
CAT II
Windows 10 permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220978
CAT II
The Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows 10 Security Technical Implementation Guide
V-253340
CAT II
Windows 11 permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows 11 Security Technical Implementation Guide
V-253341
CAT II
Windows 11 permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows 11 Security Technical Implementation Guide
V-253342
CAT II
Windows 11 permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows 11 Security Technical Implementation Guide
V-253501
CAT II
The "Manage auditing and security log" user right must only be assigned to the Administrators group.
Microsoft Windows 11 Security Technical Implementation Guide
V-224877
CAT II
Permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224878
CAT II
Permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224879
CAT II
Permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225086
CAT II
The Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205640
CAT II
Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205641
CAT II
Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205642
CAT II
Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205643
CAT II
Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254296
CAT II
Windows Server 2022 permissions for the Application event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254297
CAT II
Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254298
CAT II
Windows Server 2022 permissions for the System event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254507
CAT II
Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278043
CAT II
Windows Server 2025 permissions for the Application event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278044
CAT II
Windows Server 2025 permissions for the Security event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278045
CAT II
Windows Server 2025 permissions for the System event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278257
CAT II
The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-221161
CAT II
The audit information produced by MongoDB must be protected from unauthorized read access.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252135
CAT II
The audit information produced by MongoDB must be protected from unauthorized access.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265908
CAT II
The audit information produced by MongoDB must be protected from unauthorized access.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279336
CAT II
The audit information produced by MongoDB must be protected from unauthorized access, modification, and deletion.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-254107
CAT II
Nutanix AOS must protect log information from any type of unauthorized access.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-254183
CAT II
Nutanix AOS must protect audit information from unauthorized access.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279427
CAT II
Nutanix AOS must be configured to protect the application server log files from unauthorized access.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279575
CAT II
Nutanix OS must configure audit log permissions for 0600 or less.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219761
CAT II
The DBMS must protect audit information from any type of unauthorized access.
Oracle Database 11.2g Security Technical Implementation Guide
V-220277
CAT II
The system must protect audit information from any type of unauthorized access.
Oracle Database 12c Security Technical Implementation Guide
V-270510
CAT II
The audit information produced by the Oracle Database must be protected from unauthorized access, modification, or deletion.
Oracle Database 19c Security Technical Implementation Guide
V-221334
CAT II
OHS log files must only be accessible by privileged users.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221899
CAT II
The Oracle Linux operating system must protect audit information from unauthorized read, modification, or deletion.
Oracle Linux 7 Security Technical Implementation Guide
V-248732
CAT II
OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248733
CAT II
OL 8 audit logs must be owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248734
CAT II
OL 8 audit logs must be group-owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248735
CAT II
The OL 8 audit log directory must be owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248736
CAT II
The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248737
CAT II
The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248738
CAT II
The OL 8 audit system must protect auditing rules from unauthorized change.
Oracle Linux 8 Security Technical Implementation Guide
V-248739
CAT II
The OL 8 audit system must protect logon UIDs from unauthorized change.
Oracle Linux 8 Security Technical Implementation Guide