Skip to content

Audit pol reg edit generate #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ildar1 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Audit pol reg edit generate #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e2c7876
Added new Audit Pol STIGs
Ildar1 Jan 15, 2024
f02918c
Merge branch 'AuditPolRegEditGenerate' of https://github.com/VeriDevO…
Ildar1 Jan 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/main/java/rqcode/stigs/win10_v3/AuditPolicy/V_220748.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,12 @@ public class V_220748 extends AuditPolStig {
Map.entry("date", "2021-08-18"),
Map.entry("ruleID", "SV_220748r569187_rule"),
Map.entry("severity", "medium"),
Map.entry("checktext", "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\n\nUse the AuditPol tool to review the current Audit Policy configuration:\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\nEnter \"AuditPol /get /category:*\".\n\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\n\nAccount Logon >> Credential Validation - Failure"),
Map.entry("checktext", "Security Option \\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\ must be set to \\Enabled\\ (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\Run as Administrator\\).\\nEnter \\AuditPol /get /category:*\\.\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Failure"),
Map.entry("checkid", "C-22493r554819_chk"),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \"Audit Credential Validation\" with \"Failure\" selected."),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\Audit Credential Validation\\ with \\Failure\\ selected."),
Map.entry("fixid", "F-22482r554820_fix"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "None"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "null"),
Map.entry("version", "WN10-AU-000005")
);

Expand Down
8 changes: 4 additions & 4 deletions src/main/java/rqcode/stigs/win10_v3/AuditPolicy/V_220749.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,12 @@ public class V_220749 extends AuditPolStig {
Map.entry("date", "2021-08-18"),
Map.entry("ruleID", "SV_220749r569187_rule"),
Map.entry("severity", "medium"),
Map.entry("checktext", "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\n\nUse the AuditPol tool to review the current Audit Policy configuration:\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\nEnter \"AuditPol /get /category:*\".\n\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\n\nAccount Logon >> Credential Validation - Success"),
Map.entry("checktext", "Security Option \\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\ must be set to \\Enabled\\ (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\Run as Administrator\\).\\nEnter \\AuditPol /get /category:*\\.\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Success"),
Map.entry("checkid", "C-22490r554810_chk"),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \"Audit Credential Validation\" with \"Success\" selected."),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\Audit Credential Validation\\ with \\Success\\ selected."),
Map.entry("fixid", "F-22479r554811_fix"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "None"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "null"),
Map.entry("version", "WN10-AU-000010")
);

Expand Down
12 changes: 6 additions & 6 deletions src/main/java/rqcode/stigs/win10_v3/AuditPolicy/V_220750.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ public class V_220750 extends AuditPolStig {
*/
private final static Map<String, String> CHECK_VALUES = Map.of(
"id", "V_220750",
"guid", "{0CCE923F-69AE-11D9-BED3-505054503030}",
"guid", "{0CCE9237-69AE-11D9-BED3-505054503030}",
"subcat_es", "acierto",
"subcat_eng", "success"
);
Expand All @@ -24,7 +24,7 @@ public class V_220750 extends AuditPolStig {
*/
private final static Map<String, String> ENFORCE_VALUES = Map.of(
"id", "V_220750",
"guid", "{0CCE923F-69AE-11D9-BED3-505054503030}",
"guid", "{0CCE9237-69AE-11D9-BED3-505054503030}",
"parameter", "Success",
"value", "enable"
);
Expand All @@ -38,12 +38,12 @@ public class V_220750 extends AuditPolStig {
Map.entry("date", "2021-08-18"),
Map.entry("ruleID", "SV_220750r569187_rule"),
Map.entry("severity", "medium"),
Map.entry("checktext", "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\n\nUse the AuditPol tool to review the current Audit Policy configuration:\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\nEnter \"AuditPol /get /category:*\".\n\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\n\nAccount Management >> Security Group Management - Success"),
Map.entry("checktext", "Security Option \\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\ must be set to \\Enabled\\ (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\Run as Administrator\\).\\nEnter \\AuditPol /get /category:*\\.\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Management >> Security Group Management - Success"),
Map.entry("checkid", "C-22489r554807_chk"),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \"Audit Security Group Management\" with \"Success\" selected."),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\Audit Security Group Management\\ with \\Success\\ selected."),
Map.entry("fixid", "F-22478r554808_fix"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "None"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon."),
Map.entry("iacontrols", "null"),
Map.entry("version", "WN10-AU-000030")
);

Expand Down
12 changes: 6 additions & 6 deletions src/main/java/rqcode/stigs/win10_v3/AuditPolicy/V_220751.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ public class V_220751 extends AuditPolStig {
*/
private final static Map<String, String> CHECK_VALUES = Map.of(
"id", "V_220751",
"guid", "{0CCE923F-69AE-11D9-BED3-505054503030}",
"guid", "{0CCE9237-69AE-11D9-BED3-505054503030}",
"subcat_es", "errores",
"subcat_eng", "failure"
);
Expand All @@ -24,7 +24,7 @@ public class V_220751 extends AuditPolStig {
*/
private final static Map<String, String> ENFORCE_VALUES = Map.of(
"id", "V_220751",
"guid", "{0CCE923F-69AE-11D9-BED3-505054503030}",
"guid", "{0CCE9237-69AE-11D9-BED3-505054503030}",
"parameter", "Failure",
"value", "enable"
);
Expand All @@ -38,12 +38,12 @@ public class V_220751 extends AuditPolStig {
Map.entry("date", "2021-08-18"),
Map.entry("ruleID", "SV_220751r569187_rule"),
Map.entry("severity", "medium"),
Map.entry("checktext", "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\n\nUse the AuditPol tool to review the current Audit Policy configuration:\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\nEnter \"AuditPol /get /category:*\".\n\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\n\nAccount Management >> User Account Management - Failure"),
Map.entry("checktext", "Security Option \\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\ must be set to \\Enabled\\ (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\Run as Administrator\\).\\nEnter \\AuditPol /get /category:*\\.\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Failure"),
Map.entry("checkid", "C-22492r554816_chk"),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \"Audit User Account Management\" with \"Failure\" selected."),
Map.entry("fixtext", "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\Audit User Account Management\\ with \\Failure\\ selected."),
Map.entry("fixid", "F-22481r554817_fix"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members."),
Map.entry("iacontrols", "None"),
Map.entry("description","Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members."),
Map.entry("iacontrols", "null"),
Map.entry("version", "WN10-AU-000035")
);

Expand Down
Loading