STIGs RMF Controls Compare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

Browse STIGs
Search
RMF Controls
Compare Versions

Resources

About
Release Notes
VPAT
DISA STIG Library

STIGs updated 2 hours ago

Powered by Pylon

© 2026 Beacon Cloud Solutions, Inc. All rights reserved.

← AU-7 — Audit Record Reduction and Report Generation

CCI-001880

Definition

Provide a report generation capability that supports after-the-fact investigations of security incidents.

Parent Control

AU-7Audit Record Reduction and Report GenerationAudit and Accountability

Linked STIG Checks (41)

V-274017CAT IIAmazon Linux 2023 must have the audit package installed.Amazon Linux 2023 Security Technical Implementation Guide V-274018CAT IIAmazon Linux 2023 must produce audit records containing information to establish what type of events occurred.Amazon Linux 2023 Security Technical Implementation Guide V-268080CAT IINixOS must enable the audit daemon.Anduril NixOS Security Technical Implementation Guide V-252534CAT IIThe macOS system must enable System Integrity Protection.Apple macOS 12 (Monterey) Security Technical Implementation Guide V-257240CAT IThe macOS system must enable System Integrity Protection.Apple macOS 13 (Ventura) Security Technical Implementation Guide V-222494CAT IIThe application must provide a report generation capability that supports after-the-fact investigations of security incidents.Application Security and Development Security Technical Implementation Guide V-276014CAT IAx-OS must off-load audit records onto a different system or media than the system being audited.Axonius Federal Systems Ax-OS Security Technical Implementation Guide V-219225CAT IIThe Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide V-238298CAT IIThe Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide V-260590CAT IIUbuntu 22.04 LTS must have the "auditd" package installed.Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide V-260591CAT IIUbuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide V-270656CAT IIUbuntu 24.04 LTS must have the "auditd" package installed.Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide V-270657CAT IIUbuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide V-206501CAT IIIThe Central Log Server must be configured to generate reports that support after-the-fact investigations of security incidents.Central Log Server Security Requirements Guide V-269469CAT IIThe audit package must be installed on AlmaLinux OS 9.Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide V-269532CAT IIThe auditd service must be enabled on AlmaLinux OS 9.Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide V-203708CAT IIIThe operating system must provide a report generation capability that supports after-the-fact investigations of security incidents.General Purpose Operating System Security Requirements Guide V-215254CAT IIAIX must provide a report generation function that supports on-demand audit review and analysis, on-demand reporting requirements, and after-the-fact investigations of security incidents.IBM AIX 7.x Security Technical Implementation Guide V-205561CAT IIThe Mainframe Product must provide a report generation capability that supports after-the-fact investigations of security incidents.Mainframe Product Security Requirements Guide V-254181CAT IINutanix AOS must provide the capability to centrally review and analyze audit records from multiple components within the system.Nutanix AOS 5.20.x OS Security Technical Implementation Guide V-279565CAT IINutanix OS must have the audit.x86_64 package installed.Nutanix Acropolis GPOS Security Technical Implementation Guide V-248519CAT IIThe OL 8 audit package must be installed.Oracle Linux 8 Security Technical Implementation Guide V-248520CAT IIOL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.Oracle Linux 8 Security Technical Implementation Guide V-271519CAT IIOL 9 must have the audit package installed.Oracle Linux 9 Security Technical Implementation Guide V-271520CAT IIOL 9 audit service must be enabled.Oracle Linux 9 Security Technical Implementation Guide V-280993CAT IIRHEL 10 must have the "audit" package installed.Red Hat Enterprise Linux 10 Security Technical Implementation Guide V-280994CAT IIRHEL 10 must enable the audit service.Red Hat Enterprise Linux 10 Security Technical Implementation Guide V-258151CAT IIRHEL 9 audit package must be installed.Red Hat Enterprise Linux 9 Security Technical Implementation Guide V-258152CAT IIRHEL 9 audit service must be enabled.Red Hat Enterprise Linux 9 Security Technical Implementation Guide V-275677CAT IIUbuntu OS must have the "auditd" package installed.Riverbed NetIM OS Security Technical Implementation Guide V-275678CAT IIUbuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.Riverbed NetIM OS Security Technical Implementation Guide V-261410CAT IISLEM 5 must have the auditing package installed.SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide V-261462CAT IISLEM 5 must generate audit records for all uses of privileged functions.SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide V-217190CAT IIThe SUSE operating system must have the auditing package installed.SUSE Linux Enterprise Server 12 Security Technical Implementation Guide V-217209CAT IIIThe SUSE operating system must generate audit records for all uses of the privileged functions.SUSE Linux Enterprise Server 12 Security Technical Implementation Guide V-219960CAT IIThe audit system records must be able to be used by a report generation capability.Solaris 11 SPARC Security Technical Implementation Guide V-219989CAT IIThe audit system records must be able to be used by a report generation capability.Solaris 11 X86 Security Technical Implementation Guide V-282437CAT IITOSS 5 audit package must be installed.Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide V-282438CAT IITOSS 5 audit service must be enabled.Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide V-207460CAT IIThe VMM must provide a report generation capability that supports after-the-fact investigations of security incidents.Virtual Machine Manager Security Requirements Guide V-269586CAT IXylok Security Suite must use a central log server for auditing records.Xylok Security Suite 20.x Security Technical Implementation Guide