The IDPS must be configured to send an alert to designated personnel in the event the sensor log fails to function.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34583	SRG-NET-999999-IDPS-00224	SV-45443r1_rule		Medium

Description
Sensor event logging is a key component of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an IDPS that has been configured improperly. It is imperative that the IDPS is configured to generate an alarm when an audit failure occurs.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42792r1_chk )
Verify the IDPS components are set to send an email or other alert if the log becomes full and new log entries cannot be written. If the system is not configured to send an alert to designated personnel in the event of an audit processing failure, this is a finding.

Fix Text (F-38840r1_fix)
Configure the IDPS components to send an email or other alert if new log entries cannot be written to the log.