The network devices must be configured to alert the administrator of a potential attack or system failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3176	NET0390	SV-3176r2_rule		Medium

Description
The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.

STIG	Date
Firewall Security Technical Implementation Guide - Cisco	2017-12-07

Details

Check Text ( C-3680r3_chk )
The SA shall define clipping levels / thresholds as a baseline to display alert messages on specific attacks identifying the potential security violation or attack. Review the IDS or firewall configuration to determine what alerts have been defined and how the notifications are performed. If the device is not configured to alert the administrator of potential failures, this is a finding.

Fix Text (F-3201r2_fix)
Configure the IDS or firewall to alarm the SA of potential attacks or system failure.