The IDPS must provide audit record generation capability for organizationally defined auditable events occurring within IDPS.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34594	SRG-NET-000113-IDPS-00082	SV-45458r1_rule		Low

Description
Centrally logging the sensor information provides a central location to store, view, analyze, and produce detailed reports on alerts. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. Many events such as configuration changes and login success or failure are mandated by this control; however organizations may also define additional events for logging.

Description

Centrally logging the sensor information provides a central location to store, view, analyze, and produce detailed reports on alerts. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. Many events such as configuration changes and login success or failure are mandated by this control; however organizations may also define additional events for logging.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42808r1_chk )
Obtain a list of organizationally defined events which should be logged. Search for a sampling of these events in the audit log entries. If the IDPS audit log records do not show audit events for the organizationally defined events, this is a finding.

Fix Text (F-38855r1_fix)
Create a list of organizationally defined audit events which should be logged. Configure the IDPS components to log the required events.