STIGhub
STIGs
RMF Controls
Compare
← AU-7 — Audit Record Reduction and Report Generation
CCI-001876
Definition
Provide an audit reduction capability that supports on-demand reporting requirements.
Parent Control
AU-7
Audit Record Reduction and Report Generation
Audit and Accountability
Linked STIG Checks (45)
V-279070
CAT II
ColdFusion must be configured to support integration with a third-party Security Information and Event Management (SIEM) to support notifications.
Adobe ColdFusion Security Technical Implementation Guide
V-274017
CAT II
Amazon Linux 2023 must have the audit package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268080
CAT II
NixOS must enable the audit daemon.
Anduril NixOS Security Technical Implementation Guide
V-252534
CAT II
The macOS system must enable System Integrity Protection.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257240
CAT I
The macOS system must enable System Integrity Protection.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-222489
CAT II
The application must provide an audit reduction capability that supports on-demand reporting requirements.
Application Security and Development Security Technical Implementation Guide
V-204759
CAT II
The application server must provide a log reduction capability that supports on-demand reporting requirements.
Application Server Security Requirements Guide
V-272632
CAT II
CylanceON-PREM must be configured to support integration with a third-party Security Information and Event Management (SIEM) to support notifications.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-219225
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238298
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260590
CAT II
Ubuntu 22.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260591
CAT II
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270656
CAT II
Ubuntu 24.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270657
CAT II
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-206483
CAT II
The Central Log Server must be configured to perform audit reduction that supports on-demand reporting requirements.
Central Log Server Security Requirements Guide
V-269532
CAT II
The auditd service must be enabled on AlmaLinux OS 9.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233105
CAT II
The container platform must provide an audit reduction capability that supports on-demand reporting requirements.
Container Platform Security Requirements Guide
V-203651
CAT II
The operating system must provide an audit reduction capability that supports on-demand reporting requirements.
General Purpose Operating System Security Requirements Guide
V-215242
CAT II
AIX must provide the function to filter audit records for events of interest based upon all audit fields within audit records, support on-demand reporting requirements, and an audit reduction function that supports on-demand audit review and analysis and after-the-fact investigations of security incidents.
IBM AIX 7.x Security Technical Implementation Guide
V-255795
CAT II
The MQ Appliance messaging server must provide a log reduction capability that supports on-demand reporting requirements.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-223801
CAT II
IBM z/OS system administrator must develop a procedure to provide an audit reduction capability that supports on-demand reporting requirements.
IBM z/OS RACF Security Technical Implementation Guide
V-205511
CAT II
The Mainframe Product must provide an audit reduction capability that supports on-demand reporting requirements.
Mainframe Product Security Requirements Guide
V-272889
CAT I
Microsoft Defender for Endpoint (MDE) must be connected to a central log server.
Microsoft Defender for Endpoint Security Technical Implementation Guide
V-254181
CAT II
Nutanix AOS must provide the capability to centrally review and analyze audit records from multiple components within the system.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279565
CAT II
Nutanix OS must have the audit.x86_64 package installed.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-248519
CAT II
The OL 8 audit package must be installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271519
CAT II
OL 9 must have the audit package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271520
CAT II
OL 9 audit service must be enabled.
Oracle Linux 9 Security Technical Implementation Guide
V-253530
CAT II
Prisma Cloud Compute must be configured to send events to the hosts' syslog.
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-252846
CAT II
Rancher MCM must allocate audit record storage and generate audit records associated with events, users, and groups.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-280993
CAT II
RHEL 10 must have the "audit" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280994
CAT II
RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258151
CAT II
RHEL 9 audit package must be installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-275677
CAT II
Ubuntu OS must have the "auditd" package installed.
Riverbed NetIM OS Security Technical Implementation Guide
V-275678
CAT II
Ubuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Riverbed NetIM OS Security Technical Implementation Guide
V-261411
CAT II
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217191
CAT II
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-207397
CAT II
The VMM must support an audit reduction capability that supports on-demand reporting requirements.
Virtual Machine Manager Security Requirements Guide
V-269586
CAT I
Xylok Security Suite must use a central log server for auditing records.
Xylok Security Suite 20.x Security Technical Implementation Guide