OpenControls Logo

STIG Viewer

STIGViewer Support

The Dragos Platform must be configured to send backup audit records.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-270944DRAG-OT-000490SV-270944r1107127_ruleCCI-001348medium
Description
Configuring the Dragos Platform to send out backup audit records is a critical best practice for ensuring the security, integrity, and availability of audit data. It supports disaster recovery, regulatory compliance, forensic investigations, and overall operational resilience, thereby strengthening the organization's cybersecurity posture. Storing backup audit records in a separate location ensures that even if the primary system is compromised or experiences a failure, the audit records remain intact and secure. This separation enhances the overall integrity and security of the audit data. In the event of a catastrophic event such as a cyberattack, hardware failure, or natural disaster, having backup audit records stored offsite allows for recovery of critical audit data. This capability is essential for restoring operations and conducting post-incident analyses. In the aftermath of a security incident, forensic investigators rely on audit records to reconstruct events and understand the nature and impact of the incident. Backup audit records provide a reliable source of information for these investigations, even if the primary records are tampered with or deleted. Regularly backing up audit records ensures operational continuity by safeguarding critical data. In case of an unexpected event, the Dragos Platform can quickly access the backup records to continue monitoring and analyzing security events without significant disruption. Regular backups of audit records help ensure accountability by providing a reliable and tamper-evident log of activities. This accountability is essential for maintaining trust and transparency within the organization and with external stakeholders. Satisfies: SRG-APP-000125, SRG-APP-000515, SRG-APP-000358
STIGDate
Dragos Platform 2.x Security Technical Implementation Guide2025-05-15

Related Frameworks

2 mappings across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-08.1Event Log Backup on Separate Physical Systems / Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (35) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-11Audit Record Retention
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-12(3)Changes by Authorized Individuals
1.00

+25 more (top 10 by confidence shown)

CCI2 mappings
CCI-001348
1.00
CCI-001851
1.00

Details

Check Text (C-270944r1107127_chk)

Verify third-party server is used to offload audit records. 1. Check for a configured Syslog Server. In the UI, navigate to Admin >> Integrations. Click "LAUNCH" in the Syslog section. If a Syslog Server is not listed or Status is not connected, this is a finding. If the protocol of the Syslog Server is not TLS or mTLS, this is a finding. 2. Check for an export rule. In the UI, navigate to Notification >> RULES Tab. Verify a rule exists and has the following: Action = "Send Syslog (<your syslog server>)" Criteria = "IF Notification Type equals System" If this rule does not exist with the correct Action and Criteria, this is a finding.

Fix Text (F-74888r1107126_fix)

Create Syslog server and Rule. 1. Create a Syslog server on a third-party device. The steps may vary depending on the chosen Syslog server software. 2. Create a syslog server output in the Dragos UI. Navigate to Admin >> Integrations. Click "LAUNCH" in the Syslog section. Click "ADD NEW SERVER". Enter third-party server information, select TLS or mTLS in the protocol dropdown, and click "NEXT". Note: This step may require TLS certificate generation. Input Message Template. Click "SAVE". 3. Create a rule. Navigate to Notification >> RULES Tab. Click "NEW RULE". Fill in Name and Processing Order. Select For Rule Criteria: If ANY of the following - "Notification Type" "Equals" "System" Action = Send Syslog (third-party server) Click "SAVE".