The IDPS must produce sensor event log records that contain sufficient information to establish what type of event occurred.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34611	SRG-NET-999999-IDPS-00213	SV-45479r1_rule		Low

Description
Associating event types with detected events in the sensor logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured IDPS. Without this capability, it will be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42828r1_chk )
Examine the aggregated sensor event log on the management console. View entries for several alerts. Verify the events being captured in the sensor event logs include the type or category of the events. If the sensor event log does not include the type or category of events, this is a finding.

Fix Text (F-38876r1_fix)
Configure the sensor event log to capture the type or category of each event.