Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The IDPS must invoke a system shutdown in the event of the log failure, unless an alternative audit capability exists.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-NET-000171-IDPS-000091 | SRG-NET-000171-IDPS-000091 | SRG-NET-000171-IDPS-000091_rule | Medium |
| Description |
|---|
| It is critical when a network device is at risk of failing to process audit logs as required; it takes action to mitigate the failure. If the device were to continue processing without auditing enabled, a network device or the network itself could be compromised without any information that can be used for the trace back of an attack and for forensic analysis. |
| STIG | Date |
|---|---|
| IDPS Security Requirements Guide (SRG) | 2012-03-08 |
Details
| Check Text ( C-43219_chk ) |
|---|
| Inspect the sensor, MC, and management server event log configuration. Verify the logging server and sensors are set to shutdown if the log becomes full and new log entries cannot be written. If the IDPS is not configured to invoke a system shutdown in the event of the log failure, this is a finding. |
| Fix Text (F-43219_fix) |
|---|
| Configure the logging server and sensors to shut down in case new log entries cannot be written to the log. |