OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper SRX Services Gateway must generate a log event when privileged commands are executed.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-223187JUSX-DM-000029SV-223187r961362_ruleCCI-002234low
Description
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat. All commands executed on the Juniper SRX are privileged commands. Thus, this requirement is configured using the same syslog command as CCI-000172.
STIGDate
Juniper SRX Services Gateway NDM Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.4Auditing Use of Privileged Functions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(3)Changes by Authorized Individuals
1.00

+24 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI1 mapping
CCI-002234
1.00

Details

Check Text (C-223187r961362_chk)

Verify the device generates a log event when privileged commands are executed. [edit] show system syslog If a valid syslog host server and the syslog file names are not configured to capture "any" facility and "any" event, this is a finding.

Fix Text (F-24848r513255_fix)

Along with the other commands that constitute a complete DoD syslog configuration, the following command must be ensure privileged commands are sent to the Syslog Server. [edit] set system syslog host <IP-syslog-server> any any