The firewall implementation must transmit audit events to the organization's central audit log server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000081-FW-000058	SRG-NET-000081-FW-000058	SRG-NET-000081-FW-000058_rule		Low

Description
The organization must centrally manage the content of audit records generated by the firewall. Centrally managing audit data captured by the central firewall provides for easier management of these events and is an effective facility for monitoring and generating automatic alert. The repository of audit data can facilitate troubleshooting when problems are encountered and when performing root cause analysis. This repository can also be correlated in real time to identify suspicious behavior or be archived for future analysis. Without the ability to centrally manage events, troubleshooting and correlation of suspicious behavior would be difficult and could lead to, or prolong, an attack. To support the auditing requirement, the firewall account and audit management functions must be configured to transmit the audit events to the site's central audit server (e.g., SYSLOG server).

Description

The organization must centrally manage the content of audit records generated by the firewall. Centrally managing audit data captured by the central firewall provides for easier management of these events and is an effective facility for monitoring and generating automatic alert. The repository of audit data can facilitate troubleshooting when problems are encountered and when performing root cause analysis. This repository can also be correlated in real time to identify suspicious behavior or be archived for future analysis. Without the ability to centrally manage events, troubleshooting and correlation of suspicious behavior would be difficult and could lead to, or prolong, an attack. To support the auditing requirement, the firewall account and audit management functions must be configured to transmit the audit events to the site's central audit server (e.g., SYSLOG server).

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000081-FW-000058_chk )
Examine the audit log configuration on the firewall. Verify the firewall is configured to send audit events to the organization's central audit log server. If the firewall is not configured to send audit events to the organization's central audit log server, this is a finding.

Fix Text (F-SRG-NET-000081-FW-000058_fix)
Configure the firewall implementation, to ensure audit events are transmitted to the organizations central audit log server (e.g., SYSLOG server).