diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
new file mode 100644
index 000000000000..785b50ee44a4
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
@@ -0,0 +1,43 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+ ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ check_mode: False
+ failed_when: false
+ register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+ ansible.builtin.set_fact:
+ log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+ ansible.builtin.set_fact:
+ log_file_dir: "/var/log/audit"
+ when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file_dir from log_file_line if configured"
+ ansible.builtin.set_fact:
+ log_file_dir: "{{ log_file_line | dirname}}"
+ when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get audit log group"
+ ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
+ check_mode: False
+ failed_when: false
+ register: log_group_exists
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0700"
+ ansible.builtin.file:
+ path: "{{ log_file_dir }}"
+ mode: 0700
+ when: log_group_exists.stdout | length == 0
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0750"
+ ansible.builtin.file:
+ path: "{{ log_file_dir }}"
+ mode: 0750
+ when: log_group_exists.stdout | length > 0
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
index af7d8ce9eb7c..8aad7d5a8900 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_fedora
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml
new file mode 100644
index 000000000000..121f6a6f7a46
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml
@@ -0,0 +1,124 @@
+
+
+ {{{ oval_metadata("Checks for correct permissions for audit logs.", rule_title=rule_title) }}}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /etc/audit/auditd.conf
+ ^[ ]*log_group[ ]+=[ ](\w+)$
+ 1
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /var/log/audit
+
+
+
+
+
+
+
+
+
+ /var/log/audit
+
+
+
+
+ false
+ false
+ false
+ true
+ true
+ true
+ false
+ false
+ false
+ false
+ false
+ false
+
+
+
+ false
+ false
+ false
+ true
+ true
+ true
+ true
+ false
+ true
+ false
+ false
+ false
+
+
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
new file mode 100644
index 000000000000..8c1e4094da0c
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
@@ -0,0 +1,42 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+ ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ check_mode: False
+ failed_when: false
+ register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+ ansible.builtin.set_fact:
+ log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+ ansible.builtin.set_fact:
+ log_file: "/var/log/audit/audit.log"
+ when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file from log_file_line if configured"
+ ansible.builtin.set_fact:
+ log_file: "{{ log_file_line }}"
+ when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get all audit backup log file(s)"
+ ansible.builtin.find:
+ path: "{{ log_file | dirname }}"
+ patterns: "{{ log_file | basename }}.*"
+ register: backup_files
+
+- name: "{{{ rule_title }}} - Set root as owner to all audit backup log file(s)"
+ ansible.builtin.file:
+ path: "{{ item }}"
+ owner: root
+ loop: "{{ backup_files.files| map(attribute='path') | list }}"
+
+- name: "{{{ rule_title }}} - Set root as owner to audit log file"
+ ansible.builtin.file:
+ path: "{{ log_file }}"
+ owner: root
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
index c70a8da65a55..a672d9cb74b2 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
@@ -74,13 +74,13 @@ fixtext: |-
If the log_group is not defined or it is set to root, configure the permissions the following way:
- $ sudo chmod 0640 $log_file
- $ sudo chmod 0440 $log_file.*
+ $ sudo chmod 0600 $log_file
+ $ sudo chmod 0400 $log_file.*
Otherwise, configure the permisssions the following way:
- $ sudo chmod 0600 $log_file
- $ sudo chmod 0400 $log_file.*
+ $ sudo chmod 0640 $log_file
+ $ sudo chmod 0440 $log_file.*
srg_requirement: |-
{{{ full_name }}} audit log file must have mode 0640 or less permissive to prevent unauthorized access to the audit log.
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml
new file mode 100644
index 000000000000..3eca8b865ecd
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml
@@ -0,0 +1,224 @@
+
+
+ {{{ oval_metadata("The root account should be configured to deny access after the number of
+ defined failed attempts has been reached.", rule_title=rule_title) }}}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ^[\s]*auth\N+pam_unix\.so
+
+
+
+ ^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc
+
+
+
+^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=\b)(?=.*?\bnew_authtok_reqd=(ok|done)\b)(?=.*?\bdefault=(bad|ignore)\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=\b)(?=.*\bdefault=\b).*\])[\s]+pam_faillock\.so
+
+
+
+ ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+(?=.*authfail)(?=.*even_deny_root)[\s\S]*^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+(?=.*authsucc)(?=.*even_deny_root)
+
+
+
+ ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root
+
+
+
+^[\s]*even_deny_root
+
+
+
+
+ ^/etc/pam.d/common-auth$
+
+
+1
+
+
+
+
+
+
+
+
+^/etc/pam.d/common-auth$
+
+1
+
+
+
+
+
+
+
+
+^/etc/pam.d/common-account$
+
+1
+
+
+
+
+
+
+
+
+ ^/etc/pam.d/common-auth$
+
+1
+
+
+
+ ^/etc/pam.d/common-auth$
+
+1
+
+
+
+
+
+
+
+
+
+
+
+
+ ^/etc/security/faillock.conf$
+
+1
+
+
+
+
+
+
+
+
+
+