The FortiGate device must generate audit records containing information that establishes the identity of any individual or process associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-234178	FGFW-ND-000095	SV-234178r879568_rule	CCI-001487	medium
Description
Without information that establishes the identity of the subjects (i.e., administrators or processes acting on behalf of administrators) associated with the events, security personnel cannot determine responsibility for the potentially harmful event. Event identifiers (if authenticated or otherwise known) include, but are not limited to, user database tables, primary key values, user names, or process identifiers.
STIG			Date
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide			2023-06-01

Related Frameworks

4 paths across 3 frameworks

NIST 800-531 mapping

AU-3

1.00

DISA · 1 · disa_xccdf · related
DISA · 2025-01-23 · disa_cci_list · equivalent

NIST 800-1712 mappings

3.3.1

1.00

DISA · 1 · disa_xccdf · related
DISA · 2025-01-23 · disa_cci_list · equivalent
NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent

3.3.2

1.00

DISA · 1 · disa_xccdf · related
DISA · 2025-01-23 · disa_cci_list · equivalent
NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent

CCI1 mapping

CCI-001487

1.00

DISA · 1 · disa_xccdf · related

Details

Check Text (C-234178r879568_chk)

Log in to the FortiGate GUI with Super-Admin privilege. 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following commands: # show full-configuration log setting | grep -i anonymize The output should be: set user-anonymize disable If the log setting user-anonymize is set to enable, this is a finding.

Fix Text (F-37328r611722_fix)

Log in to the FortiGate GUI with Super-Admin privilege. 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following commands: # config log setting # set user-anonymize disable # end