The firewall implementation must capture and log sufficient information to establish the identity of user accounts associated with the audit event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000079-FW-000056	SRG-NET-000079-FW-000056	SRG-NET-000079-FW-000056_rule		Low

Description
Log record content that may be necessary to satisfy this requirement includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control ACLs or policy filters invoked. This capability is critical for accurate forensic analysis.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000079-FW-000056_chk )
Examine the audit log configuration on the firewall or view several alert records on organization's central audit log server. Search for events showing some or all of the following: timestamps, source and destination addresses, user/process identifiers, event descriptions, success or failure indications, file names involved, and access control or flow control ACLs or policy filters invoked. If the audit log event records do not include sufficient information to establish the identity of any user accounts associated with the event, this is a finding.

Check Text ( C-SRG-NET-000079-FW-000056_chk )

Examine the audit log configuration on the firewall or view several alert records on organization's central audit log server.
Search for events showing some or all of the following: timestamps, source and destination addresses, user/process identifiers, event descriptions, success or failure indications, file names involved, and access control or flow control ACLs or policy filters invoked.

If the audit log event records do not include sufficient information to establish the identity of any user accounts associated with the event, this is a finding.

Fix Text (F-SRG-NET-000079-FW-000056_fix)
Configure the firewall implementation, to ensure entries sent to the audit log include sufficient information to establish the identity of any user accounts associated with the event (e.g., timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control ACLs or policy filters invoked).