The IDPS must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000090-IDPS-000094	SRG-NET-000090-IDPS-000094	SRG-NET-000090-IDPS-000094_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. Collecting log data and presenting that data in a single, consolidated view achieves this objective.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. Collecting log data and presenting that data in a single, consolidated view achieves this objective.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43222_chk )
Inspect the management console. Verify audit tools are installed or integrated which provide audit review, analysis, and reporting. If the management console or other IDPS component does not have audit tools which allow audit review, analysis, and reporting of sensor log events, this is a finding. If the IDPS or another network component does not provide the capability to review, analyze, and report on events in the application audit log, this is a finding.

Check Text ( C-43222_chk )

Inspect the management console. Verify audit tools are installed or integrated which provide audit review, analysis, and reporting.

If the management console or other IDPS component does not have audit tools which allow audit review, analysis, and reporting of sensor log events, this is a finding. If the IDPS or another network component does not provide the capability to review, analyze, and report on events in the application audit log, this is a finding.

Fix Text (F-43222_fix)
Install a management console/server with audit tools for audit review, analysis, and reporting. Provide the capability to perform audit reviews, analysis, and reporting for the application audit log.