The Symantec Endpoint Protection client Global Settings for Log Retention must be enabled and configured to retain logs for 30 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42611	DTASEP003	SV-55339r1_rule		Medium

Description
Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems. Logs are also useful when performing auditing and forensic analysis, supporting internal investigations, establishing baselines, and identifying operational trends and long-term problems. (FISMA 800-92)

Description

Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems. Logs are also useful when performing auditing and forensic analysis, supporting internal investigations, establishing baselines, and identifying operational trends and long-term problems. (FISMA 800-92)

STIG	Date
Symantec Endpoint Protection 12.1 Managed Client Antivirus	2015-07-08

Details

Check Text ( C-48892r1_chk )
Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Advanced Options -> Select Miscellaneous -> Select the Log Handling tab -> Under Log Retention -> Ensure "Delete logs older than" is set to 30 days or greater. Criteria: If "Delete logs older than" is not set to 30 days or greater, this is a finding. On the client machine use the Windows Registry Editor to navigate to the following key: 32 bit: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV 64 bit: HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV Criteria: If the value data for the LogFileRollOverDays values is not 1e (the hex value for 30) or higher, this is a finding.

Check Text ( C-48892r1_chk )

Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Advanced Options -> Select Miscellaneous -> Select the Log Handling tab -> Under Log Retention -> Ensure "Delete logs older than" is set to 30 days or greater.

Criteria: If "Delete logs older than" is not set to 30 days or greater, this is a finding.

On the client machine use the Windows Registry Editor to navigate to the following key:
32 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV
64 bit:
HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV

Criteria: If the value data for the LogFileRollOverDays values is not 1e (the hex value for 30) or
higher, this is a finding.

Fix Text (F-48193r1_fix)
From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click on the applied policy -> Under Windows Settings, Advanced Options -> Select Miscellaneous -> Select the Log Handling tab -> Under Log Retention -> Set "Delete logs older than" to 30 days or greater.