The IDPS must be configured to send an alert to designated personnel in the event of an audit processing failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000088-IDPS-000092	SRG-NET-000088-IDPS-000092	SRG-NET-000088-IDPS-000092_rule		Medium

Description
Auditing and logging are key components of any security architecture. It is essential that security personnel know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify a IDPS that has been configured improperly. It is imperative that the IDPS is configured to generate an alarm when an audit failure occurs.

Description

Auditing and logging are key components of any security architecture. It is essential that security personnel know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify a IDPS that has been configured improperly. It is imperative that the IDPS is configured to generate an alarm when an audit failure occurs.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43220_chk )
Verify the logging server and sensors are set to send an email or other alert if the log becomes full and new log entries cannot be written. If the system is not configured to send an alert to designated personnel in the event of an audit processing failure, this is a finding.

Fix Text (F-43220_fix)
Configure the logging server and sensors to send an email or other alert if new log entries cannot be written to the log.