The IDPS must off-load log records to a centralized log server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-206902	SRG-NET-000334-IDPS-00191	SV-206902r856540_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

Description

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

STIG	Date
Intrusion Detection and Prevention Systems Security Requirements Guide	2024-05-30

Details

Check Text ( C-7156r298218_chk )
Verify the IDPS off-loads log records to a centralized log server. If the IDPS does not off-load log records to a centralized log server, this is a finding.

Fix Text (F-7156r298219_fix)
Configure the IDPS to off-load log records to a centralized log server.