OpenControls Logo

STIG Viewer

STIGViewer Support

Xylok Security Suite must use a central log server for auditing records.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269586XYLK-20-000291SV-269586r1053533_ruleCCI-003821high
Description
Integrating a central log server for managing audit records within the Xylok Security Suite enhances security monitoring, incident response, and compliance efforts. By providing centralized logging, real-time analysis, and automated alerting, a central log server allows Xylok to maintain a robust security posture and effectively respond to potential threats, ultimately contributing to the organization's overall security strategy. Satisfies: SRG-APP-000745, SRG-APP-000115, SRG-APP-000125, SRG-APP-000181, SRG-APP-000358, SRG-APP-000362, SRG-APP-000363, SRG-APP-000364, SRG-APP-000365, SRG-APP-000366, SRG-APP-000367, SRG-APP-000368, SRG-APP-000369, SRG-APP-000370, SRG-APP-000376, SRG-APP-000750, SRG-APP-000755, SRG-APP-000760, SRG-APP-000765, SRG-APP-000770, SRG-APP-000775, SRG-APP-000780, SRG-APP-000785, SRG-APP-000790, SRG-APP-000795, SRG-APP-000800, SRG-APP-000805, SRG-APP-000515
STIGDate
Xylok Security Suite 20.x Security Technical Implementation Guide2024-12-13

Related Frameworks

25 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02Secure Baseline Configurations
1.00
CHG-04.1Automated Access Enforcement / Auditing
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
IAC-21Least Privilege
1.00
IRO-02Incident Handling
1.00
IRO-08Chain of Custody & Forensics
1.00
IRO-09Situational Awareness For Incidents
1.00
IRO-13Root Cause Analysis (RCA) & Lessons Learned
1.00
MON-01Continuous Monitoring
1.00

+8 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (73) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00

+63 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.6
1.00
3.3.8
1.00
CCI25 mappings
CCI-000158
1.00
CCI-001348
1.00
CCI-001851
1.00
CCI-001875
1.00
CCI-001876
1.00
CCI-001877
1.00
CCI-001878
1.00
CCI-001879
1.00
CCI-001880
1.00
CCI-001881
1.00

+15 more (top 10 by weight shown)

NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-10
1.00
PR.PS-04
1.00
RS.AN-03
1.00
RS.AN-06
1.00
RS.AN-07
1.00

Who does this work

15 NICE work roles and 11 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-269586r1053533_chk)

Verify SIEM. On the host server, ensure /etc/rsyslog.d/101-xylok.conf exists and contains the following contents: $ModLoad imfile $InputFileName /var/log/xylok/api/current $InputFileTag xylok-api: $InputFileStateFile /tmp/xylok-api-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/db/current $InputFileTag xylok-db: $InputFileStateFile /tmp/xylok-db-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/mx/current $InputFileTag xylok-mx: $InputFileStateFile /tmp/xylok-mx-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/primary/current $InputFileTag xylok-primary: $InputFileStateFile /tmp/xylok-primary-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/web/current $InputFileTag xylok-web: $InputFileStateFile /tmp/xylok-web-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/worker/current $InputFileTag xylok-worker: $InputFileStateFile /tmp/xylok-worker-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor If the file contents do not monitor all logs in /var/log/xylok/, this is a finding. If the rsyslog destination is not configured to send logs to a valid syslog server, this is a finding. Note: The rsyslog destination host may appear in a different file, often following a format similar to “*.* @siem.example.com:514.

Fix Text (F-73520r1053532_fix)

Create /etc/rsyslog.d/100-xylok.conf with these contents, ensuring the final line points to a valid syslog server. $ModLoad imfile $InputFileName /var/log/xylok/api/current $InputFileTag xylok-api: $InputFileStateFile /tmp/xylok-api-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/db/current $InputFileTag xylok-db: $InputFileStateFile /tmp/xylok-db-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/mx/current $InputFileTag xylok-mx: $InputFileStateFile /tmp/xylok-mx-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/primary/current $InputFileTag xylok-primary: $InputFileStateFile /tmp/xylok-primary-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/web/current $InputFileTag xylok-web: $InputFileStateFile /tmp/xylok-web-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor $InputFileName /var/log/xylok/worker/current $InputFileTag xylok-worker: $InputFileStateFile /tmp/xylok-worker-log-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor Restart rsyslog to apply changes: sudo systemctl restart rsyslog