The IDPS must send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-206891 | SRG-NET-000249-IDPS-00222 | SV-206891r383131_rule | CCI-001243 | medium |
| Description | ||||
| Without an alert, security personnel may be unaware of an impending failure of the audit capability, and the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The IDPS generates an immediate (within seconds) alert which notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. | ||||
| STIG | Date | |||
| Intrusion Detection and Prevention Systems Security Requirements Guide | 2025-05-19 | |||
Related Frameworks
7 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
SI-3
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1715 mappings
3.14.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.3
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.4
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.5
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-001243
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-206891r383131_chk)
Verify the IDPS sends an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected.
If the IDPS does not send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected, this is a finding.
Fix Text (F-7145r298186_fix)
Configure the IDPS to send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected.