Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-34583 | SRG-NET-999999-IDPS-00224 | SV-45443r1_rule | Medium |
Description |
---|
Sensor event logging is a key component of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an IDPS that has been configured improperly. It is imperative that the IDPS is configured to generate an alarm when an audit failure occurs. |
STIG | Date |
---|---|
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide | 2012-11-19 |
Check Text ( C-42792r1_chk ) |
---|
Verify the IDPS components are set to send an email or other alert if the log becomes full and new log entries cannot be written. If the system is not configured to send an alert to designated personnel in the event of an audit processing failure, this is a finding. |
Fix Text (F-38840r1_fix) |
---|
Configure the IDPS components to send an email or other alert if new log entries cannot be written to the log. |