OpenControls Logo

STIG Viewer

STIGViewer Support

In the event of a logging failure caused by the lack of audit record storage capacity, the SMS must continue generating and storing audit records, overwriting the oldest audit records in a first-in-first-out manner using Audit Log maintenance.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-242186TIPP-IP-000200SV-242186r710101_ruleCCI-000140medium
Description
It is critical that when the TPS is at risk of failing to process audit logs as required, it takes action to mitigate the failure. The IDPS performs a critical security function, so its continued operation is imperative. Since availability of the TPS is an overriding concern, shutting down the system in the event of an audit failure should be avoided, except as a last resort.
STIGDate
Trend Micro TippingPoint IDPS Security Technical Implementation Guide2024-09-16

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05Response To Event Log Processing Failures
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-3(2)Centralized Management of Planned Audit Record Content
1.00
AU-4Audit Log Storage Capacity
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.4
1.00
CCI1 mapping
CCI-000140
1.00

Details

Check Text (C-242186r710101_chk)

1. In the Trend Micro SMS interface, go to the "Admin" tab, and select "Database". Each item in the database maintenance section has a configurable item to ensure when the newest logs will overwrite the oldest logs. This is configured through the number of rows: a. The Events log must be set to at least 30,000,000 rows, with an age of 90 days. b. The Audit Log must be set 1,000,000 rows and an age of 365 days. c. The Device Audit Log must be set 1,000,000 rows and an age of 365 days. d. The Device System Log must be set 1,000,000 rows and an age of 365 days. If these values are not set, this is a finding.

Fix Text (F-45419r710100_fix)

1. In the Trend Micro SMS interface, go to the "Admin" tab, and select "Database". 2. Make the following changes: a. The Events log must be set to at least 30,000,000 rows, with an age of 90 days. b. The Audit Log must be set 1,000,000 rows and an age of 365 days. c. The Device Audit Log must be set 1,000,000 rows and an age of 365 days. d. The Device System Log must be set 1,000,000 rows and an age of 365 days.