The firewall implementation must produce application log records that capture organizationally defined additional information (identified by type, location, or subject) to the records for the events detected by the firewall application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37352	SRG-NET-999999-FW-000182	SV-49113r1_rule		Low

Description
Firewall application logs must be configured to capture all organizationally defined information deemed necessary for possible event investigation and traceability. This additional information may include timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. This capability is critical for accurate forensic analysis.

Description

Firewall application logs must be configured to capture all organizationally defined information deemed necessary for possible event investigation and traceability. This additional information may include timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. This capability is critical for accurate forensic analysis.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45599r1_chk )
Verify log view settings can be reorganized to view the log entries by type, location or subject. Verify the application logs categorize each event logged by a minimum event type, location, and a description of the event. If firewall implementation application log entries do not include a minimum of event type, location, and a description of the event for each event captured, this is a finding.

Fix Text (F-42277r1_fix)
Configure the firewall implementation and central management server to categorize each alert. Alerts will include event type, location, and a description of the event.