The IDPS must capture and log sufficient information to establish the identity of any user accounts associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000079-IDPS-000076	SRG-NET-000079-IDPS-000076	SRG-NET-000079-IDPS-000076_rule		Low

Description
Log records content that may be necessary to satisfy the requirement of this control includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. This capability is critical for accurate forensic analysis.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43204_chk )
Examine the IDPS central log. Search for events showing some or all of the following is being logged, as applicable, to the exiting entries. Timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. If sufficient information to establish the identity of any user accounts associated with the event is not capture and log, this is a finding.

Check Text ( C-43204_chk )

Examine the IDPS central log.
Search for events showing some or all of the following is being logged, as applicable, to the exiting entries.
Timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.

If sufficient information to establish the identity of any user accounts associated with the event is not capture and log, this is a finding.

Fix Text (F-43204_fix)
Configure the IDPS to capture and log the following at a minimum: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.