controls:
    -   id: SRG-OS-000037-GPOS-00015
        levels:
            - medium
        title: {{{ full_name }}} must produce audit records containing information to
            establish what type of events occurred.
        rules:
            - audit_rules_dac_modification_chmod
            - audit_rules_dac_modification_chown
            - audit_rules_dac_modification_fchmod
            - audit_rules_dac_modification_fchmodat
            - audit_rules_dac_modification_fchmodat2
            - audit_rules_dac_modification_fchown
            - audit_rules_dac_modification_fchownat
            - audit_rules_dac_modification_fremovexattr
            - audit_rules_dac_modification_fsetxattr
            - audit_rules_dac_modification_lchown
            - audit_rules_dac_modification_lremovexattr
            - audit_rules_dac_modification_lsetxattr
            - audit_rules_dac_modification_removexattr
            - audit_rules_dac_modification_setxattr
            - audit_rules_dac_modification_umount
            - audit_rules_dac_modification_umount2
            - audit_rules_execution_chacl
            - audit_rules_execution_setfacl
            - audit_rules_execution_chcon
            - audit_rules_execution_semanage
            - audit_rules_execution_setfiles
            - audit_rules_execution_setsebool
            - audit_rules_file_deletion_events_rename
            - audit_rules_file_deletion_events_renameat
            - audit_rules_file_deletion_events_renameat2
            - audit_rules_file_deletion_events_rmdir
            - audit_rules_file_deletion_events_unlink
            - audit_rules_file_deletion_events_unlinkat
            - audit_rules_unsuccessful_file_modification_creat
            - audit_rules_unsuccessful_file_modification_ftruncate
            - audit_rules_unsuccessful_file_modification_open
            - audit_rules_unsuccessful_file_modification_open_by_handle_at
            - audit_rules_unsuccessful_file_modification_openat
            - audit_rules_unsuccessful_file_modification_truncate
            - audit_rules_kernel_module_loading_delete
            - audit_rules_kernel_module_loading_finit
            - audit_rules_kernel_module_loading_init
            - audit_rules_login_events_lastlog
            - audit_rules_privileged_commands_chage
            - audit_rules_privileged_commands_chsh
            - audit_rules_privileged_commands_crontab
            - audit_rules_privileged_commands_gpasswd
            - audit_rules_privileged_commands_kmod
            - audit_rules_privileged_commands_modprobe
            - audit_rules_privileged_commands_mount
            - audit_rules_privileged_commands_newgrp
            - audit_rules_privileged_commands_pam_timestamp_check
            - audit_rules_privileged_commands_passwd
            - audit_rules_privileged_commands_pkexec
            - audit_rules_privileged_commands_postdrop
            - audit_rules_privileged_commands_postqueue
            - audit_rules_privileged_commands_ssh_agent
            - audit_rules_privileged_commands_ssh_keysign
            - audit_rules_privileged_commands_su
            - audit_rules_privileged_commands_sudo
            - audit_rules_privileged_commands_sudoedit
            - audit_rules_privileged_commands_umount
            - audit_rules_privileged_commands_unix_chkpwd
            - audit_rules_privileged_commands_unix_update
            - audit_rules_privileged_commands_userhelper
            - audit_rules_privileged_commands_usermod
            - audit_rules_media_export
            - audit_rules_sudoers
            - audit_rules_sudoers_d
            - audit_rules_usergroup_modification_group
            - audit_rules_usergroup_modification_gshadow
            - audit_rules_usergroup_modification_opasswd
            - audit_rules_usergroup_modification_passwd
            - audit_rules_usergroup_modification_shadow
            - grub2_audit_argument
            - service_auditd_enabled
            - package_audit_installed
        status: automated
