<def-group>
  <definition class="compliance" id="audit_rules_unsuccessful_file_modification" version="1">
    {{{ oval_metadata("Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.") }}}

    <criteria operator="AND">
      <extend_definition comment="audit creat" definition_ref="audit_rules_unsuccessful_file_modification_creat" />
      <extend_definition comment="audit ftruncate" definition_ref="audit_rules_unsuccessful_file_modification_ftruncate" />
      <extend_definition comment="audit openat" definition_ref="audit_rules_unsuccessful_file_modification_openat" />
      <extend_definition comment="audit open_by_handle_at" definition_ref="audit_rules_unsuccessful_file_modification_open_by_handle_at" />
      <extend_definition comment="audit open" definition_ref="audit_rules_unsuccessful_file_modification_open" />
      <extend_definition comment="audit truncate" definition_ref="audit_rules_unsuccessful_file_modification_truncate" />
    </criteria>
  </definition>

</def-group>
