The HP FlexFabric Switch must off-load audit records onto a different system or media than the system being audited.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-217478 | HFFS-ND-000127 | SV-217478r961860_rule | CCI-001851 | medium |
| Description | ||||
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. | ||||
| STIG | Date | |||
| HP FlexFabric Switch NDM Security Technical Implementation Guide | 2025-06-12 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
AU-4(1)
1.00
- DISA · V1R4 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-001851
1.00
- DISA · V1R4 · disa_xccdf · related
Details
Check Text (C-217478r961860_chk)
Determine if the HP FlexFabric Switch is configured to use an external syslog server:
[HP] display info-center
Information Center: Enabled
Console: Enabled
Monitor: Enabled
Log host: Enabled
Source address interface: M-GigabitEthernet0/0/0
192.168.100.12,
port number: 514, host facility: local7
Log buffer: Enabled
Max buffer size 1024, current buffer size 512
Current messages 356, dropped messages 0, overwritten messages 0
Log file: Enabled
Security log file: Enabled
Information timestamp format:
Log host: Date
Other output destination: Date
If the HP FlexFabric Switch is not configure to use an external syslog server, this is a finding.
Fix Text (F-18700r293110_fix)
Configure the HP FlexFabric Switch to forward its log to an external syslog server:
[HP] info-center loghost 192.168.100.12