#
# A group of rules regarding audit operating system functionality
#
# SLES-16 ids allocated for this group from SLES-16-16016500 till SLES-16-16016699
#

controls:
    - id: SLES-16-16016500
      levels:
          - hipaa
      title: Enable the selinuxuser_execmod SELinux Boolean in SLE16
      rules:
          - sebool_selinuxuser_execmod
      status: automated
    - id: SLES-16-16016505
      levels:
          - hipaa
      title: Enable service for audit logs in SLE16
      rules:
          - service_auditd_enabled
      status: automated
    - id: SLES-16-16016510
      levels:
          - hipaa
      title: Enable remote logging functionality in SLE16
      rules:
          - rsyslog_remote_loghost
      status: automated
    - id: SLES-16-16016515
      levels:
          - pcidss4
      title: SLE16 system should capture invalid login access attempts
      status: automated
      rules:
          - display_login_attempts

    - id: SLES-16-16016520
      levels:
          - pcidss4
      title: SLE16 system should audit syscalls
      status: automated
      rules:
          - audit_rules_enable_syscall_auditing

    - id: SLES-16-16016525
      levels:
          - pcidss4
          - anssi_minimal
          - hipaa
      title: SLE16 system should audit renameat2 syscalls
      status: automated
      rules:
          - audit_rules_file_deletion_events_renameat2

    - id: SLES-16-16016530
      levels:
          - pcidss4
          - anssi_minimal
      title: SLE16 system should audit SELinux settings modifications
      status: automated
      rules:
          - audit_rules_mac_modification_etc_selinux

    - id: SLES-16-16016535
      levels:
          - pcidss4
      title: SLE16 system should record the computer node name in the audit events
      status: automated
      rules:
          - var_auditd_name_format=fqd
          - auditd_name_format

    - id: SLES-16-16016540
      levels:
          - pcidss4
          - anssi_minimal
          - hipaa
      title: SLE16 system should audit fchmodat2 syscalls
      status: automated
      rules:
          - audit_rules_dac_modification_fchmodat2

    - id: SLES-16-16016545
      levels:
          - pcidss4
      title: SLE16 system should audit access to /var/log/audit
      status: automated
      rules:
          - directory_access_var_log_audit
