OpenControls Logo

STIG Viewer

STIGViewer Support

The FortiGate device must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-234218FGFW-ND-000295SV-234218r1137890_ruleCCI-002605high
Description
The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can be used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, is important in showing whether someone is an internal employee or an outside threat.
STIGDate
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide2025-11-19

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-05Contingency Plan Root Cause Analysis (RCA) & Lessons Learned
1.00
CPL-03Control Conformity Monitoring
1.00
CPL-03.2Functional Review Of Security, Compliance & Resilience Controls
1.00
GOV-05Measures of Performance
1.00
IAO-02Assessments
1.00
IAO-02.4Security Assessment Report (SAR)
1.00
IAO-05Capabilities Deficiency Tracking
1.00
IRO-13Root Cause Analysis (RCA) & Lessons Learned
1.00
MNT-01Maintenance Operations
1.00
MNT-02Controlled Maintenance
1.00

+14 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5(2)Real-time Alerts
1.00
AU-9Protection of Audit Information
1.00

+7 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.14.1
1.00
3.14.2
1.00
3.14.3
1.00
CCI1 mapping
CCI-002605
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

ID.IM-01
1.00
ID.IM-02
1.00
ID.IM-03
1.00
PR.PS-02
1.00
ID.RA-01
0.50
ID.RA-08
0.50

Who does this work

16 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-234218r1137890_chk)

Verify that FortiGate is configured to send logs to a central log server. Log in via the FortiGate GUI with super-admin privileges. 1. Navigate to Log and Report. 2. Navigate to Log Settings. 3. Locate the Remote Logging and Archiving section. 4. Verify FortiGate is configured to log to a FortiAnalyzer or a syslog server. or Open a CLI console via SSH or from the "CLI Console" button in the GUI. Run the following commands and verify that at least one of the settings reflects "set status enable" in the output: # show full-configuration | grep -A1 'log fortianalyzer' # show full-configuration | grep -A1 'log syslogd.* setting' The CLI output will indicate "set status enable" if configured. If the FortiGate is not logging to a central log server, this is a finding.

Fix Text (F-37368r917639_fix)

Log in via the GUI with super-admin privileges. 1. Click Log and Report. 2. Click Log Settings. 3. Locate the Remote Logging and Archiving section. 4. Configure FortiGate to log to a FortiAnalyzer or syslog server. - Enable logging to FortiAnalyzer and provide the IP address. Additional FortiAnalyzer logging destinations can be configured in the CLI. - Enable the "Send logs to syslog" toggle and provide the IP address. Additional syslog logging destinations can be configured in the CLI. 5. Apply changes. or 1. Open a CLI console via SSH or from the "CLI Console" button in the GUI. 2. Configure a FortiAnalyzer or syslog server with the following commands: FortiAnalyzer Logging: config log fortianalyzer setting set status enable set server {IP Address} set upload-option realtime end syslog Logging: config log syslogd setting set status enable set server {IP Address} set mode reliable end