metadata/service/rules/ciscat.yml

applications:
- auditd
classes:
- service.auditd.support
parameters:
  auditd:
    rules:
      filter_fs:
      - binfmt_misc
      - cgroup
      - debugfs
      - devpts
      - devtmpfs
      - fusectl
      - hugetlbfs
      - mqueue
      - nsfs
      - proc
      - pstore
      - securityfs
      - sysfs
      filter_paths:
      - /var/lib/docker
      options:
        enabled: 2
        bufsize: 8192
      rules:
        100:
          key: MAC_policy
          enabled: true
          rule_list:
          - '-w /etc/apparmor/ -p wa'
          - '-w /etc/apparmor.d/ -p wa'
        110:
          key: access
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295'
        120:
          key: actions
          enabled: true
          rule_list:
          - '-w /var/log/sudo.log -p wa'
        130:
          key: delete
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295'
        140:
          key: identity
          enabled: true
          rule_list:
          - '-w /etc/group -p wa'
          - '-w /etc/passwd -p wa'
          - '-w /etc/gshadow -p wa'
          - '-w /etc/shadow -p wa'
          - '-w /etc/security/opasswd -p wa'
        150:
          key: logins
          enabled: true
          rule_list:
          - '-w /var/log/faillog -p wa'
          - '-w /var/log/lastlog -p wa'
          - '-w /var/log/tallylog -p wa'
        160:
          key: modules
          enabled: true
          rule_list:
          - '-w /sbin/insmod -p x'
          - '-w /sbin/rmmod -p x'
          - '-w /sbin/modprobe -p x'
          - '-a always,exit -F arch=b64 -S init_module -S delete_module'
        170:
          key: mounts
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295'
        180:
          key: perm_mod
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
          - '-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295'
        190:
          key: privileged
          enabled: true
        200:
          key: scope
          enabled: true
          rule_list:
          - '-w /etc/sudoers -p wa'
          - '-w /etc/sudoers.d -p wa'
        210:
          key: session
          enabled: true
          rule_list:
          - '-w /var/run/utmp -p wa'
          - '-w /var/log/wtmp -p wa'
          - '-w /var/log/btmp -p wa'
        220:
          key: system_locale
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S sethostname -S setdomainname'
          - '-a always,exit -F arch=b32 -S sethostname -S setdomainname'
          - '-w /etc/issue -p wa'
          - '-w /etc/issue.net -p wa'
          - '-w /etc/hosts -p wa'
          - '-w /etc/network -p wa'
          - '-w /etc/networks -p wa'
        230:
          key: time_change
          enabled: true
          rule_list:
          - '-a always,exit -F arch=b64 -S adjtimex -S settimeofday'
          - '-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime'
          - '-a always,exit -F arch=b64 -S clock_settime'
          - '-a always,exit -F arch=b32 -S clock_settime'
          - '-w /etc/localtime -p wa'