The firewall implementation must produce application log records that capture sufficient information to establish the identity of any user account associated with the events detected by the firewall application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37351	SRG-NET-999999-FW-000181	SV-49112r1_rule		Low

Description
Log record content that may be necessary to satisfy the requirement of this control includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. This capability is critical for accurate forensic analysis.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45598r1_chk )

Examine the firewall application log. Search for events showing some or all of the following is being logged, as applicable, to the exiting entries: timestamps, source and destination addresses, user or process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. If sufficient information to establish the identity of any user account associated with the event is not captured and logged, this is a finding.

Fix Text (F-42276r1_fix)
Configure the firewall implementation to capture and log the following at a minimum: timestamps, source and destination addresses, user or process identifiers, event descriptions, success or failure indications, file names involved, and access control or flow control rules invoked.