OpenControls Logo

STIG Viewer

STIGViewer Support

Xylok Security Suite must use a central log server for auditing records.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269586XYLK-20-000291SV-269586r1155158_ruleCCI-003821high
Description
Integrating a central log server for managing audit records within the Xylok Security Suite enhances security monitoring, incident response, and compliance efforts. By providing centralized logging, real-time analysis, and automated alerting, a central log server allows Xylok to maintain a robust security posture and effectively respond to potential threats, ultimately contributing to the organization's overall security strategy. Satisfies: SRG-APP-000745, SRG-APP-000115, SRG-APP-000125, SRG-APP-000181, SRG-APP-000358, SRG-APP-000362, SRG-APP-000363, SRG-APP-000364, SRG-APP-000365, SRG-APP-000366, SRG-APP-000367, SRG-APP-000368, SRG-APP-000369, SRG-APP-000370, SRG-APP-000376, SRG-APP-000750, SRG-APP-000755, SRG-APP-000760, SRG-APP-000765, SRG-APP-000770, SRG-APP-000775, SRG-APP-000780, SRG-APP-000785, SRG-APP-000790, SRG-APP-000795, SRG-APP-000800, SRG-APP-000805, SRG-APP-000515
STIGDate
Xylok Security Suite 20.x Security Technical Implementation Guide2025-12-04

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(2)Real-time Alerts
1.00
AU-6(4)Central Review and Analysis
1.00
AU-7Audit Record Reduction and Report Generation
1.00
AU-7(1)Automatic Processing
1.00
AU-9Protection of Audit Information
1.00
AU-9(2)Store on Separate Physical Systems or Components
1.00

+4 more (top 10 by confidence shown)

CCI1 mapping
CCI-003821
1.00

Details

Check Text (C-269586r1155158_chk)

Verify that journald sends logs to rsyslog: # grep ForwardToSyslog /etc/systemd/journald.conf ForwardToSyslog=yes If ForwardToSyslog is commented out or not set to "yes," this is a finding. Verify that rsyslog is set to receive journald logs: # grep '\(imuxsock\|imjournal\)' /etc/rsyslog.conf /etc/rsyslog.d/* module(load="imuxsock") # provides support for local system logging module(load="imjournal") # provides access to the systemd journal If either module is not present or disabled, this is a finding. # grep '[[:space:]]@.*' /etc/rsyslog.conf /etc/rsyslog.d/* *.* @@yoursiem:1234 If rsyslog is not configured to forward logs to a central SIEM server, this is a finding.

Fix Text (F-73520r1155157_fix)

Edit /etc/systemd/journald.conf to include at least these lines: [Journal] ForwardToSyslog=yes Edit /etc/rsyslog.conf to include these lines: module(load="imuxsock") # provides support for local system logging module(load="imjournal") # provides access to the systemd journal *.* @@yoursiem:1234 Ensure yoursiem:1234 points to the correct host and port for your network. Restart journald and rsyslogd: # systemctl restar rsyslog systemd-journald