STIGhub
STIGs
RMF Controls
Compare
← AU-9 — Protection of Audit Information
CCI-000164
Definition
Protect audit information from unauthorized deletion.
Parent Control
AU-9
Protection of Audit Information
Audit and Accountability
Linked STIG Checks (200)
V-279036
CAT II
The ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.
Adobe ColdFusion Security Technical Implementation Guide
V-279055
CAT I
ColdFusion must be using an enterprise solution for authentication.
Adobe ColdFusion Security Technical Implementation Guide
V-274108
CAT II
Amazon Linux 2023 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Amazon Linux 2023 Security Technical Implementation Guide
V-274109
CAT II
Amazon Linux 2023 audit log directory must be owned by root to prevent unauthorized read access.
Amazon Linux 2023 Security Technical Implementation Guide
V-274110
CAT II
Amazon Linux 2023 audit logs file must have mode "0600" or less permissive to prevent unauthorized access to the audit log.
Amazon Linux 2023 Security Technical Implementation Guide
V-274187
CAT II
Amazon Linux 2023 audit system must protect logon user identifiers (UIDs) from unauthorized change.
Amazon Linux 2023 Security Technical Implementation Guide
V-268090
CAT II
The NixOS audit package must be installed.
Anduril NixOS Security Technical Implementation Guide
V-268119
CAT II
NixOS audit system must protect logon UIDs from unauthorized change.
Anduril NixOS Security Technical Implementation Guide
V-214236
CAT II
The log information from the Apache web server must be protected from unauthorized modification or deletion.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214315
CAT II
The log information from the Apache web server must be protected from unauthorized deletion and modification.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222947
CAT II
Jar files in the $CATALINA_HOME/bin/ folder must have their permissions set to 640.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252471
CAT II
The macOS system must be configured with audit log folders set to mode 700 or less permissive.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257177
CAT II
The macOS system must be configured with audit log folders set to mode 700 or less permissive.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268432
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268433
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268456
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268457
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268458
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268459
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268460
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268461
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268462
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268463
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268464
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268465
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268473
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268474
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268475
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-269095
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277040
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277041
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277063
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277064
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277065
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277066
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277067
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277068
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277069
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277070
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277071
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277072
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277080
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277081
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277082
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277083
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204938
CAT II
The ALG must protect audit information from unauthorized deletion.
Application Layer Gateway Security Requirements Guide
V-222502
CAT II
The application must protect audit information from unauthorized deletion.
Application Security and Development Security Technical Implementation Guide
V-204734
CAT II
The application server must protect log information from unauthorized deletion.
Application Server Security Requirements Guide
V-237324
CAT II
The ArcGIS Server must protect audit information from any type of unauthorized read access, modification or deletion.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-255966
CAT I
The Arista network Arista device must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-79007
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from unauthorized deletion.
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
V-254708
CAT II
The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from unauthorized deletion.
BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide
V-237357
CAT II
The CA API Gateway must protect audit information from unauthorized deletion.
CA API Gateway ALG Security Technical Implementation Guide
V-219231
CAT II
The Ubuntu operating system must be configured so that the audit log directory is not write-accessible by unauthorized users.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219232
CAT II
The Ubuntu operating system must allow only authorized accounts to own the audit log directory.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-219233
CAT II
The Ubuntu operating system must ensure only authorized groups can own the audit log directory and its underlying files.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238248
CAT II
The Ubuntu operating system must be configured so that the audit log directory is not write-accessible by unauthorized users.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260598
CAT II
Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260599
CAT II
Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260600
CAT II
Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270828
CAT II
Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270829
CAT II
Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270830
CAT II
Ubuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221916
CAT II
The Central Log Server must protect audit information from unauthorized deletion.
Central Log Server Security Requirements Guide
V-215676
CAT II
The Cisco router must be configured to protect audit information from unauthorized deletion.
Cisco IOS Router NDM Security Technical Implementation Guide
V-220584
CAT II
The Cisco switch must be configured to protect audit information from unauthorized deletion.
Cisco IOS Switch NDM Security Technical Implementation Guide
V-215821
CAT II
The Cisco router must be configured to protect audit information from unauthorized deletion.
Cisco IOS XE Router NDM Security Technical Implementation Guide
V-220532
CAT II
The Cisco switch must be configured to protect audit information from unauthorized deletion.
Cisco IOS XE Switch NDM Security Technical Implementation Guide
V-269536
CAT II
AlmaLinux OS 9 audit log directory must be owned by root to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269537
CAT II
AlmaLinux OS 9 audit log directory must have 0700 permissions to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269538
CAT II
AlmaLinux OS 9 audit logs must be owned by the root group to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269539
CAT II
AlmaLinux OS 9 audit logs must be owned by root to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269540
CAT II
AlmaLinux OS 9 audit logs must have 0600 permissions to prevent unauthorized read access.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233058
CAT II
The container platform must protect audit information from unauthorized deletion.
Container Platform Security Requirements Guide
V-233531
CAT II
The audit information produced by PostgreSQL must be protected from unauthorized deletion.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261877
CAT II
The audit information produced by PostgreSQL must be protected from unauthorized deletion.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206540
CAT II
The audit information produced by the DBMS must be protected from unauthorized deletion.
Database Security Requirements Guide
V-224150
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213581
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-260005
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must protect session (call) records from unauthorized deletion.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259230
CAT II
The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-217393
CAT II
The BIG-IP appliance must be configured to protect audit information from unauthorized deletion.
F5 BIG-IP Device Management Security Technical Implementation Guide
V-215751
CAT II
The BIG-IP Core implementation must be configured to protect audit information from unauthorized deletion.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-278388
CAT II
NGINX must protect audit information from unauthorized access.
F5 NGINX Security Technical Implementation Guide
V-206688
CAT II
The firewall must protect the traffic log from unauthorized deletion of local log files and log records.
Firewall Security Requirements Guide
V-234185
CAT II
The FortiGate device must protect audit information from unauthorized deletion.
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V-234143
CAT I
The FortiGate firewall must protect the traffic log from unauthorized deletion of local log files and log records.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203618
CAT II
The operating system must protect audit information from unauthorized deletion.
General Purpose Operating System Security Requirements Guide
V-217449
CAT II
The HP FlexFabric Switch must protect audit information from unauthorized deletion.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-268255
CAT II
The HYCU virtual appliance must protect audit information from unauthorized deletion.
HYCU Protege Security Technical Implementation Guide
V-215243
CAT II
Audit logs on the AIX system must be owned by root.
IBM AIX 7.x Security Technical Implementation Guide
V-215244
CAT II
Audit logs on the AIX system must be group-owned by system.
IBM AIX 7.x Security Technical Implementation Guide
V-215245
CAT II
Audit logs on the AIX system must be set to 660 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-252559
CAT II
The IBM Aspera Console must protect audit information from unauthorized read access.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252592
CAT II
IBM Aspera Faspex must protect audit information from unauthorized modification.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252609
CAT II
IBM Aspera Shares must protect audit information from unauthorized deletion.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-213684
CAT II
The audit information produced by DB2 must be protected from unauthorized deletion.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-250328
CAT II
The WebSphere Liberty Server must protect log information from unauthorized access or changes.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-255850
CAT II
The WebSphere Application Server must protect log information from unauthorized deletion.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223554
CAT II
IBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223701
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS RACF Security Technical Implementation Guide
V-223881
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS TSS Security Technical Implementation Guide
V-237907
CAT II
CA VM:Secure product AUDIT file must be restricted to authorized personnel.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-258600
CAT I
The ICS must be configured to prevent nonprivileged users from executing privileged functions.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-213515
CAT II
File permissions must be configured to protect log information from unauthorized deletion.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253897
CAT II
The Juniper EX switch must be configured to protect audit information from unauthorized deletion.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-217318
CAT II
The Juniper router must be configured to protect audit information from unauthorized deletion.
Juniper Router NDM Security Technical Implementation Guide
V-213822
CAT II
The audit information produced by SQL Server must be protected from unauthorized deletion.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213944
CAT II
The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205479
CAT II
The Mainframe Product must protect audit information from unauthorized deletion.
Mainframe Product Security Requirements Guide
V-253681
CAT II
The audit information produced by MariaDB must be protected from unauthorized deletion.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220351
CAT II
The audit information produced by MarkLogic Server must be protected from unauthorized deletion.
MarkLogic Server v9 Security Technical Implementation Guide
V-255332
CAT II
The audit information produced by Azure SQL Database must be protected from unauthorized deletion.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276298
CAT II
The audit information produced by Azure SQL Managed Instance must be protected from unauthorized access.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-225227
CAT II
CAS and policy configuration files must be backed up.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-221214
CAT II
Exchange audit data must be protected against unauthorized access for deletion.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-228368
CAT II
Exchange must protect audit data against unauthorized deletion.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259587
CAT II
Exchange audit data must be protected against unauthorized access for deletion.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259662
CAT II
Exchange must protect audit data against unauthorized deletion.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-283673
CAT II
The log information from the IIS 10.0 website must be protected from unauthorized modification or deletion.
Microsoft IIS 10.0 Site Security Technical Implementation Guide
V-271282
CAT II
The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-220782
CAT II
Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220783
CAT II
Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220784
CAT II
Windows 10 permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows 10 Security Technical Implementation Guide
V-220978
CAT II
The Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows 10 Security Technical Implementation Guide
V-224877
CAT II
Permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224878
CAT II
Permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-224879
CAT II
Permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-225086
CAT II
The Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205640
CAT II
Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205641
CAT II
Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205642
CAT II
Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-205643
CAT II
Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254296
CAT II
Windows Server 2022 permissions for the Application event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254297
CAT II
Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254298
CAT II
Windows Server 2022 permissions for the System event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-254507
CAT II
Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278043
CAT II
Windows Server 2025 permissions for the Application event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278044
CAT II
Windows Server 2025 permissions for the Security event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278045
CAT II
Windows Server 2025 permissions for the System event log must prevent access by nonprivileged accounts.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-278257
CAT II
The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-221161
CAT II
The audit information produced by MongoDB must be protected from unauthorized read access.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252135
CAT II
The audit information produced by MongoDB must be protected from unauthorized access.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265908
CAT II
The audit information produced by MongoDB must be protected from unauthorized access.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279336
CAT II
The audit information produced by MongoDB must be protected from unauthorized access, modification, and deletion.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202041
CAT II
The network device must protect audit information from unauthorized deletion.
Network Device Management Security Requirements Guide
V-254107
CAT II
Nutanix AOS must protect log information from any type of unauthorized access.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-254183
CAT II
Nutanix AOS must protect audit information from unauthorized access.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279427
CAT II
Nutanix AOS must be configured to protect the application server log files from unauthorized access.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279575
CAT II
Nutanix OS must configure audit log permissions for 0600 or less.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219763
CAT II
The DBMS must protect audit information from unauthorized deletion.
Oracle Database 11.2g Security Technical Implementation Guide
V-220279
CAT II
The system must protect audit information from unauthorized deletion.
Oracle Database 12c Security Technical Implementation Guide
V-270510
CAT II
The audit information produced by the Oracle Database must be protected from unauthorized access, modification, or deletion.
Oracle Database 19c Security Technical Implementation Guide
V-221336
CAT II
The log information from OHS must be protected from unauthorized deletion.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221899
CAT II
The Oracle Linux operating system must protect audit information from unauthorized read, modification, or deletion.
Oracle Linux 7 Security Technical Implementation Guide
V-248732
CAT II
OL 8 audit logs must have a mode of "0600" or less permissive to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248733
CAT II
OL 8 audit logs must be owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248734
CAT II
OL 8 audit logs must be group-owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248735
CAT II
The OL 8 audit log directory must be owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248736
CAT II
The OL 8 audit log directory must be group-owned by root to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248737
CAT II
The OL 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access.
Oracle Linux 8 Security Technical Implementation Guide
V-248738
CAT II
The OL 8 audit system must protect auditing rules from unauthorized change.
Oracle Linux 8 Security Technical Implementation Guide
V-248739
CAT II
The OL 8 audit system must protect logon UIDs from unauthorized change.
Oracle Linux 8 Security Technical Implementation Guide
V-271583
CAT II
OL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Oracle Linux 9 Security Technical Implementation Guide
V-271584
CAT II
OL 9 audit log directory must be owned by root to prevent unauthorized read access.
Oracle Linux 9 Security Technical Implementation Guide
V-271585
CAT II
OL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
Oracle Linux 9 Security Technical Implementation Guide
V-271885
CAT II
OL 9 audit system must protect logon UIDs from unauthorized change.
Oracle Linux 9 Security Technical Implementation Guide
V-271886
CAT II
OL 9 audit system must protect auditing rules from unauthorized change.
Oracle Linux 9 Security Technical Implementation Guide
V-235101
CAT II
The audit information produced by the MySQL Database Server 8.0 must be protected from unauthorized deletion.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-214068
CAT II
The audit information produced by PostgreSQL must be protected from unauthorized deletion.
PostgreSQL 9.x Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-281050
CAT II
RHEL 10 must enforce group ownership of audit logs by "root" or by a restricted logging group to prevent unauthorized read access.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281051
CAT II
RHEL 10 must enforce "root" ownership of the audit log directory to prevent unauthorized read access.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281052
CAT II
RHEL 10 must enforce "root" ownership of audit logs to prevent unauthorized access.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281053
CAT II
RHEL 10 must enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281054
CAT II
RHEL 10 must set mode "0600" or less permissive for the audit logs file to prevent unauthorized access to the audit log.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281055
CAT II
RHEL 10 must enforce the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281365
CAT II
RHEL 10 must prevent unauthorized changes to the audit system.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-228564
CAT II
The Red Hat Enterprise Linux operating system must protect audit information from unauthorized read, modification, or deletion.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-258165
CAT II
RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258166
CAT II
RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258167
CAT II
RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258228
CAT II
RHEL 9 audit system must protect logon UIDs from unauthorized change.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258229
CAT II
RHEL 9 audit system must protect auditing rules from unauthorized change.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257533
CAT II
OpenShift must protect audit information from unauthorized modification.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251204
CAT II
The audit information produced by Redis Enterprise DBMS must be protected from unauthorized deletion.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275684
CAT II
Ubuntu OS must be configured to permit only authorized users ownership of the audit log files.
Riverbed NetIM OS Security Technical Implementation Guide
V-275685
CAT II
Ubuntu OS must permit only authorized groups ownership of the audit log files.
Riverbed NetIM OS Security Technical Implementation Guide
V-275686
CAT II
Ubuntu OS must be configured so that the audit log directory is not write-accessible by unauthorized users.
Riverbed NetIM OS Security Technical Implementation Guide
V-256079
CAT I
The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
Riverbed NetProfiler Security Technical Implementation Guide
V-261418
CAT II
SLEM 5 must protect audit rules from unauthorized modification.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217202
CAT II
The SUSE operating system must protect audit rules from unauthorized modification.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-221935
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
V-251672
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 8.x for Linux Security Technical Implementation Guide
V-279251
CAT I
The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-241126
CAT II
Trend Deep Security must protect audit information from unauthorized deletion.
Trend Micro Deep Security 9.x Security Technical Implementation Guide
V-252977
CAT II
TOSS audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide