The IDPS must provide the capability to automatically process log records for events of interest based upon selectable criteria.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000095-IDPS-000095	SRG-NET-000095-IDPS-000095	SRG-NET-000095-IDPS-000095_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. Collecting log data and enabling personnel to filter the data based on selection criteria to produce a meaningful view achieves this objective.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. Collecting log data and enabling personnel to filter the data based on selection criteria to produce a meaningful view achieves this objective.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43224_chk )
Verify the central management server has the capability to set up jobs or automatically generated reports based on organizationally defined criteria. If the IDPS management console used cannot be configured to automatically process log record and produce customized reports, this is a finding.

Fix Text (F-43224_fix)
Use an IDPS that has the capability to automatically process log records for events of interest; or install a forensics or aggregation server that provides this service.