OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ASA must be configured to off-load log records to a centralized log server.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-239879CASA-IP-000110SV-239879r856155_ruleCCI-001851medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.
STIGDate
Cisco ASA IPS Security Technical Implementation Guide2024-08-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-08.1Event Log Backup on Separate Physical Systems / Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-14(1)System Start-up
1.00

+24 more (top 10 by confidence shown)

CCI1 mapping
CCI-001851
1.00

Details

Check Text (C-239879r856155_chk)

Verify that a syslog server has been defined. Step 1: Navigate to Configuration >> ASA Firepower Configuration >> Policies > Actions Alerts. The Alerts page appears. Step 2: Verify the IP address and port number of the syslog server. If the Cisco ASA is not configured to send log records to a centralized log server, this is a finding.

Fix Text (F-43071r665949_fix)

Configure Firepower to send log records to a syslog server as shown in the following steps: Step 1: Navigate to Configuration >> ASA Firepower Configuration >> Policies >> Actions Alerts. Step 2: Click the Create Alert drop-down menu and choose option Create Syslog Alert. Step 3: Enter the following values for the Syslog server: Host: Specify the IP address/hostname of Syslog server. Port: Specify the port number of Syslog server. Step 4: Click Store ASA FirePOWER Changes.