| The organization must centrally manage the content of audit records generated by the firewall. Centrally managing audit data captured by the central firewall provides for easier management of these events and is an effective facility for monitoring and generating automatic alert. The repository of audit data can facilitate troubleshooting when problems are encountered and when performing root cause analysis. This repository can also be correlated in real time to identify suspicious behavior or be archived for future analysis. Without the ability to centrally manage events, troubleshooting and correlation of suspicious behavior would be difficult and could lead to, or prolong, an attack.
To support the auditing requirement, the firewall account and audit management functions must be configured to transmit the audit events to the site's central audit server (e.g., SYSLOG server). |
