OpenControls Logo

STIG Viewer

STIGViewer Support

The Dragos Platform must alert the information system security officer (ISSO), information system security manager (ISSM), and other individuals designated by the local organization when events are detected that indicate a compromise or potential for compromise.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271070DRAG-OT-002120SV-271070r1107133_ruleCCI-002664medium
Description
When a security event occurs, Dragos Platform must immediately notify the appropriate support personnel so they can respond appropriately. Alerts may be generated from a variety of sources, including audit records or inputs from malicious code protection mechanisms, intrusion detection mechanisms, or prevention mechanisms. IOCs are forensic artifacts from intrusions that are identified on organizational information systems (at the host or network level). IOCs provide organizations with valuable information on objects or information systems that have been compromised. These indicators reflect the occurrence of a compromise or a potential compromise.
STIGDate
Dragos Platform 2.x Security Technical Implementation Guide2025-05-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01.4System Generated Alerts
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
SC-7(9)Restrict Threatening Outgoing Communications Traffic
1.00
SI-3Malicious Code Protection
1.00
SI-4(1)System-wide Intrusion Detection System
1.00
SI-4(22)Unauthorized Network Services
1.00
SI-4(5)System-generated Alerts
1.00
CCI1 mapping
CCI-002664
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.PS-04
1.00

Details

Check Text (C-271070r1107133_chk)

1. Check Server Configuration. If using Syslog Server: Verify third-party server is used to receive communication-related notifications. Check for a configured Syslog Server. In the UI, navigate to Admin >> Integrations. Click "LAUNCH" in the Syslog section. If no server is configured or the status is not "Connected", this is a finding. If no recipient is configured, this is a finding. 2. Check Rules: Navigate to Notification >> RULES Tab. Verify a rule exists and has the following: Action = "Send (<your syslog server>)" Criteria = "Notification Type Equals System" "Notification Type Equals System Failure" If a rule does not exist with the correct Action and Criteria, this is a finding.

Fix Text (F-75014r1107132_fix)

1. Configure Servers. If using Syslog Server: Create a Syslog server on a third-party device. The steps may vary depending on the chosen Syslog server software. Refer to 2.3.x Dragos Platform Syslog Integration Guide in the Customer Portal for additional help. Create a syslog server output in the Dragos UI. Navigate to Admin >> Integrations. Click "LAUNCH" in the Syslog section. Click "ADD NEW SERVER". Enter third-party server information and click "NEXT". Input Message Template. Click "SAVE". 2. Creating System Rules: Navigate to Notification >> RULES Tab. Click "NEW RULE". Fill in Name and Processing Order. Create two Attributes. Click "ADD ATTRIBUTE" in the "If ANY of the following" block: Type = "Notification Type" Select Operation = "Equals" Select Value = "System" Click "ADD ATTRIBUTE" in the "If ANY of the following" block: Type = "Notification Type" Select Operation = "Equals" Select Value = "System failure" In the "THEN perform the following actions block: Click "ADD ACTION". Action = "Send (<your syslog server>)" Click "SAVE".