Repository navigation
Log a superset of STIG/CIS event classes; add baseline comparison - #6
Merged
Merged
Conversation
Windows: - Audit Success and Failure on every subcategory that can fail (Account Lockout, IPsec Driver, Other System Events, Detailed File Share, File System, Registry were Success only); enable the IPsec Main/Quick/Extended Mode categories. - Per-object audit rules now audit failures as well as successes. - Write the Event Log policy MaxSize values for Security, System and Application so a policy refresh cannot shrink the logs we sized. - Size and enable more channels: WinRM, RDP client and RdpCoreTS, LSA, DeviceGuard, Netlogon, SMB Server, Shell-Core, AppX deployment, Winlogon. Linux: - Add winlogs-extra.rules (password history, execpriv, exec_as_root), installed as 91-; move the "-e 1" enable into 99- so file order is correct. macOS: - Add file permission/ownership/flag/ACL/xattr, link/clone/copy, time, ptrace, task-port, process suspend and authorization events. Docs: new docs/baseline-comparison.md explaining what is logged beyond STIG/CIS and where WinLogs deliberately differs (immutable rules, halt on full, forwarding, OpenBSM, log-size scanners). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The goal is for WinLogs to log at least every event class the STIG and CIS baselines require, plus more, without taking on their hardening settings. This PR closes the gaps found by comparing against them and documents where we deliberately differ.
Windows
MaxSizevalues for Security, System and Application. Policy overrides the per-channel setting, so a policy refresh could otherwise shrink the logs we sized; scanners that read the policy value also see it. Restored on-Revert.Linux
linux/audit/winlogs-extra.rules(installed as91-): password history,execpriv(setuid/setgid binaries running as root) andexec_as_root(a logged-in human running something as root).-e 1moves to its own99-file so augenrules loads everything in the right order.macOS
esloggersupports).Docs
docs/baseline-comparison.md: what we log beyond the baselines, and a table of deliberate differences (Linux immutable rules and halt-on-full, central forwarding, macOS OpenBSM, log-size scanners). Linked from the README; the per-OS pages are updated.Testing
CI passes on Windows Server 2022/2025, Windows 11 ARM64, Ubuntu 22.04/24.04, the Fedora container and macOS 14/15. The Windows test now also asserts the new Success-and-Failure categories and the policy
MaxSizevalue and its revert; the Linux test asserts the new rule files exist, are loaded and are removed on revert.Not tested: the new Windows channel names on every build (missing channels are skipped silently, so a wrong name just does nothing), the new rules producing events on a real multi-user Linux host, the extra macOS events on a Mac without pre-granted Full Disk Access, and a real domain controller.
Notes
The baseline comparison was built from public mirrors of the STIG and CIS text, and only the items it lists were confirmed. It is a logging comparison, not a compliance claim.
Generated by Claude Code