Update RHEL8 CIS refereces for logging and auditing rules

Reviewed the fourth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules
alanmcanonical · Jul 15, 2022 · 95cfa85 · 95cfa85
1 parent 9babd56
commit 95cfa85
Show file tree

Hide file tree

Showing 50 changed files with 50 additions and 49 deletions.
diff --git a/...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml b/...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml b/...ting/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml
@@ -41,7 +41,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml
@@ -55,7 +55,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml
@@ -50,7 +50,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/...ing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml b/...ditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml
@@ -55,7 +55,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml
@@ -50,7 +50,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...uditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/...uditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml
@@ -54,7 +54,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml
@@ -50,7 +50,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.10
     cis@rhel7: 4.1.9
-    cis@rhel8: 4.1.9
+    cis@rhel8: 4.1.3.9
     cis@sle12: 4.1.9
     cis@sle15: 4.1.9
     cis@ubuntu2004: 4.1.9

diff --git a/...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml b/...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml
@@ -34,7 +34,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.14
     cis@rhel7: 4.1.13
-    cis@rhel8: 4.1.14
+    cis@rhel8: 4.1.3.13
     cis@sle12: 4.1.13
     cis@sle15: 4.1.13
     cis@ubuntu2004: 4.1.13

diff --git a/...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml
@@ -34,7 +34,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.14
     cis@rhel7: 4.1.13
-    cis@rhel8: 4.1.14
+    cis@rhel8: 4.1.3.13
     cis@sle12: 4.1.13
     cis@sle15: 4.1.13
     cis@ubuntu2004: 4.1.13

diff --git a/...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/...nfigure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml
@@ -34,7 +34,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.14
     cis@rhel7: 4.1.13
-    cis@rhel8: 4.1.14
+    cis@rhel8: 4.1.3.13
     cis@sle12: 4.1.13
     cis@sle15: 4.1.13
     cis@ubuntu2004: 4.1.13

diff --git a/...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/...igure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml
@@ -34,7 +34,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.14
     cis@rhel7: 4.1.13
-    cis@rhel8: 4.1.14
+    cis@rhel8: 4.1.3.13
     cis@sle12: 4.1.13
     cis@sle15: 4.1.13
     cis@ubuntu2004: 4.1.13

diff --git a/...e_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/...e_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
@@ -44,7 +44,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.11
     cis@rhel7: 4.1.10
-    cis@rhel8: 4.1.10
+    cis@rhel8: 4.1.3.7
     cis@sle12: 4.1.10
     cis@sle15: 4.1.10
     cis@ubuntu2004: 4.1.10

diff --git a/...les/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/...les/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
@@ -47,7 +47,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.11
     cis@rhel7: 4.1.10
-    cis@rhel8: 4.1.10
+    cis@rhel8: 4.1.3.7
     cis@sle12: 4.1.10
     cis@sle15: 4.1.10
     cis@ubuntu2004: 4.1.10

diff --git a/...re_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/...re_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
@@ -47,7 +47,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.11
     cis@rhel7: 4.1.10
-    cis@rhel8: 4.1.10
+    cis@rhel8: 4.1.3.7
     cis@sle12: 4.1.10
     cis@sle15: 4.1.10
     cis@ubuntu2004: 4.1.10

diff --git a/..._rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/..._rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
@@ -47,7 +47,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.11
     cis@rhel7: 4.1.10
-    cis@rhel8: 4.1.10
+    cis@rhel8: 4.1.3.7
     cis@sle12: 4.1.10
     cis@sle15: 4.1.10
     cis@ubuntu2004: 4.1.10

diff --git a/...ules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml b/...ules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml
@@ -47,7 +47,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.11
     cis@rhel7: 4.1.10
-    cis@rhel8: 4.1.10
+    cis@rhel8: 4.1.3.7
     cis@sle12: 4.1.10
     cis@sle15: 4.1.10
     cis@ubuntu2004: 4.1.10

diff --git a/...igure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml b/...igure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml
@@ -39,7 +39,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.17
     cis@rhel7: 4.1.16
-    cis@rhel8: 4.1.15
+    cis@rhel8: 4.1.3.19
     cis@sle12: 4.1.16
     cis@sle15: 4.1.16
     cis@ubuntu2004: 4.1.16

diff --git a/...nfigure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml b/...nfigure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml
@@ -38,7 +38,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.17
     cis@rhel7: 4.1.16
-    cis@rhel8: 4.1.15
+    cis@rhel8: 4.1.3.19
     cis@sle12: 4.1.16
     cis@sle15: 4.1.16
     cis@ubuntu2004: 4.1.16

diff --git a/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml b/...ting/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml
@@ -41,7 +41,7 @@ references:
     cis@alinux2: 4.1.8
     cis@alinux3: 4.1.3.12
     cis@rhel7: 4.1.7
-    cis@rhel8: 4.1.4
+    cis@rhel8: 4.1.3.12
     cis@sle12: 4.1.7
     cis@sle15: 4.1.7
     cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01

diff --git a/...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml b/...iting/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml
@@ -37,7 +37,7 @@ references:
     cis@alinux2: 4.1.8
     cis@alinux3: 4.1.3.12
     cis@rhel7: 4.1.7
-    cis@rhel8: 4.1.4
+    cis@rhel8: 4.1.3.12
     cis@sle12: 4.1.7
     cis@sle15: 4.1.7
     cis@ubuntu2004: 4.1.7

diff --git a/...configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml b/...configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/rule.yml
@@ -34,7 +34,7 @@ identifiers:
 references:
     cis@alinux2: 4.1.17
     cis@rhel7: 4.1.16
-    cis@rhel8: 4.1.15
+    cis@rhel8: 4.1.3.19
     cis@sle12: 4.1.16
     cis@sle15: 4.1.16
     cis@ubuntu2004: 4.1.16

diff --git a/...nfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml b/...nfigure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/rule.yml
@@ -38,7 +38,7 @@ identifiers:
 references:
     cis@alinux2: 4.1.17
     cis@rhel7: 4.1.16
-    cis@rhel8: 4.1.15
+    cis@rhel8: 4.1.3.19
     cis@sle12: 4.1.16
     cis@sle15: 4.1.16
     cis@ubuntu2004: 4.1.16

diff --git a/..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml b/..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/rule.yml
@@ -34,7 +34,7 @@ identifiers:
 references:
     cis@alinux2: 4.1.17
     cis@rhel7: 4.1.16
-    cis@rhel8: 4.1.15
+    cis@rhel8: 4.1.3.19
     cis@sle12: 4.1.16
     cis@sle15: 4.1.16
     cis@ubuntu2004: 4.1.16

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml
@@ -36,7 +36,7 @@ references:
     cis@alinux2: 4.1.18
     cis@alinux3: 4.1.3.28
     cis@rhel7: 4.1.17
-    cis@rhel8: 4.1.17
+    cis@rhel8: 4.1.3.20
     cis@sle12: 4.1.17
     cis@sle15: 4.1.17
     cis@ubuntu2004: 4.1.17

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/rule.yml
@@ -31,7 +31,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux2: 4.1.7
     cis@rhel7: 4.1.6
-    cis@rhel8: 4.1.7
+    cis@rhel8: 4.1.3.14
     cis@sle12: 4.1.6
     cis@sle15: 4.1.6
     cjis: 5.4.1.1

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml
@@ -37,7 +37,7 @@ references:
     cis@alinux2: 4.1.13
     cis@alinux3: 4.1.3.10
     cis@rhel7: 4.1.12
-    cis@rhel8: 4.1.12
+    cis@rhel8: 4.1.3.10
     cis@sle12: 4.1.12
     cis@sle15: 4.1.12
     cjis: 5.4.1.1

diff --git a/...de/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/rule.yml b/...de/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/rule.yml
@@ -42,7 +42,7 @@ references:
     cis@alinux2: 4.1.6
     cis@alinux3: 4.1.3.5
     cis@rhel7: 4.1.5
-    cis@rhel8: 4.1.8
+    cis@rhel8: 4.1.3.5
     cis@sle12: 4.1.5
     cis@sle15: 4.1.5
     cis@ubuntu2004: 4.1.5

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
@@ -38,7 +38,7 @@ references:
     cis@alinux2: 4.1.9
     cis@alinux3: 4.1.3.11
     cis@rhel7: 4.1.8
-    cis@rhel8: 4.1.5
+    cis@rhel8: 4.1.3.11
     cis@sle12: 4.1.8
     cis@sle15: 4.1.8
     cis@ubuntu2004: 4.1.8

diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml
@@ -34,7 +34,7 @@ references:
     cis@alinux2: 4.1.15
     cis@alinux3: 4.1.3.1
     cis@rhel7: 4.1.14
-    cis@rhel8: 4.1.3
+    cis@rhel8: 4.1.3.1
     cis@sle12: 4.1.14
     cis@sle15: 4.1.15
     cis@ubuntu2004: 4.1.14

diff --git a/.../system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml b/.../system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml
@@ -40,7 +40,7 @@ references:
     cis@alinux2: 4.1.5
     cis@alinux3: 4.1.3.8
     cis@rhel7: 4.1.4
-    cis@rhel8: 4.1.11
+    cis@rhel8: 4.1.3.8
     cis@sle12: 4.1.4
     cis@sle15: 4.1.4
     cis@ubuntu2004: 4.1.4

diff --git a/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml b/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml
@@ -40,7 +40,7 @@ references:
     cis@alinux2: 4.1.5
     cis@alinux3: 4.1.3.8
     cis@rhel7:  4.1.4
-    cis@rhel8: 4.1.11
+    cis@rhel8: 4.1.3.8
     cis@sle12: 4.1.4
     cis@sle15: 4.1.4
     cis@ubuntu2004: 4.1.4

diff --git a/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml b/...ystem/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml
@@ -40,7 +40,7 @@ references:
     cis@alinux2: 4.1.5
     cis@alinux3: 4.1.3.8
     cis@rhel7: 4.1.4
-    cis@rhel8: 4.1.11
+    cis@rhel8: 4.1.3.8
     cis@sle12: 4.1.4
     cis@sle15: 4.1.4
     cis@ubuntu2004: 4.1.4

diff --git a/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml b/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml
@@ -40,7 +40,7 @@ references:
     cis@alinux2: 4.1.5
     cis@alinux3: 4.1.3.8
     cis@rhel7: 4.1.4
-    cis@rhel8: 4.1.11
+    cis@rhel8: 4.1.3.8
     cis@sle12: 4.1.4
     cis@sle15: 4.1.4
     cis@ubuntu2004: 4.1.4

diff --git a/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml b/...system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml
@@ -40,7 +40,7 @@ references:
     cis@alinux2: 4.1.5
     cis@alinux3: 4.1.3.8
     cis@rhel7: 4.1.4
-    cis@rhel8: 4.1.11
+    cis@rhel8: 4.1.3.8
     cis@sle12: 4.1.4
     cis@sle15: 4.1.4
     cis@ubuntu2004: 4.1.4

diff --git a/...ystem/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/rule.yml b/...ystem/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/rule.yml
@@ -42,7 +42,7 @@ references:
     cis@alinux2: 4.1.4
     cis@alinux3: 4.1.3.4
     cis@rhel7: 4.1.3
-    cis@rhel8: 4.1.6
+    cis@rhel8: 4.1.3.4
     cis@sle12: 4.1.3
     cis@sle15: 4.1.3
     cis@ubuntu2004: 4.1.3

diff --git a/.../auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/rule.yml b/.../auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/rule.yml
@@ -41,7 +41,7 @@ references:
     cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9
     cis@alinux3: 4.1.3.4
     cis@rhel7: 4.1.3
-    cis@rhel8: 4.1.6
+    cis@rhel8: 4.1.3.4
     cis@ubuntu2004: 4.1.3
     cjis: 5.4.1.1
     cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01

diff --git a/...e/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/rule.yml b/...e/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/rule.yml
@@ -46,7 +46,7 @@ references:
     cis@alinux2: 4.1.4
     cis@alinux3: 4.1.3.4
     cis@rhel7: 4.1.3
-    cis@rhel8: 4.1.6
+    cis@rhel8: 4.1.3.4
     cis@sle12: 4.1.3
     cis@sle15: 4.1.3
     cis@ubuntu2004: 4.1.3

diff --git a/...uditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/rule.yml b/...uditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/rule.yml
@@ -36,7 +36,7 @@ references:
     cis@alinux2: 4.1.4
     cis@alinux3: 4.1.3.4
     cis@rhel7: 4.1.3
-    cis@rhel8: 4.1.6
+    cis@rhel8: 4.1.3.4
     cis@sle12: 4.1.3
     cis@sle15: 4.1.3
     cis@ubuntu2004: 4.1.3