The IDPS must be configured to send an alert to designated personnel in the event of an audit processing failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34554	SRG-NET-000088-IDPS-00068	SV-45396r1_rule		Low

Description
Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the IDPS becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the IDPS is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of IDPS to write to the central audit log.

Description

Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the IDPS becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the IDPS is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of IDPS to write to the central audit log.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42745r1_chk )
View the list of configured alerts. Verify an alert is sent to designated personnel when the IDPS is unable to write to the central audit log server. If the system does not send an alert to designated personnel when an audit processing failure occurs, this is a finding.

Fix Text (F-38793r1_fix)
Configure the IDPS to provide an alert to designated personnel when an audit processing failure is detected.