The network device must transmit audit events to the organization's central audit log server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000081-NDM-000055	SRG-NET-000081-NDM-000055	SRG-NET-000081-NDM-000055_rule		Low

Description
The organization must centrally manage the content of audit records generated by the network device. Centrally managing audit data captured by the central network device provides for easier management of these events and is an effective facility for monitoring and generating automatic alert. The repository of audit data can facilitate troubleshooting when problems are encountered and when performing root cause analysis. This repository can also be correlated in real time to identify suspicious behavior or be archived for future analysis. Without the ability to centrally manage events, troubleshooting and correlation of suspicious behavior would be difficult and could lead to, or prolong, an attack. To support the auditing requirement, the network device account and audit management functions must be configured to transmit the audit events to the site's central audit server (e.g., SYSLOG server).

Description

The organization must centrally manage the content of audit records generated by the network device. Centrally managing audit data captured by the central network device provides for easier management of these events and is an effective facility for monitoring and generating automatic alert. The repository of audit data can facilitate troubleshooting when problems are encountered and when performing root cause analysis. This repository can also be correlated in real time to identify suspicious behavior or be archived for future analysis. Without the ability to centrally manage events, troubleshooting and correlation of suspicious behavior would be difficult and could lead to, or prolong, an attack. To support the auditing requirement, the network device account and audit management functions must be configured to transmit the audit events to the site's central audit server (e.g., SYSLOG server).

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000081-NDM-000055_chk )
Examine the audit log configuration on the network device. Verify the network device is configured to send audit events to the organization's central audit log server. If the network device is not configured to send audit events to the organization's central audit log server, this is a finding.

Fix Text (F-SRG-NET-000081-NDM-000055_fix)
Configure the network device to ensure audit events are transmitted to the organizations central audit log server (e.g., SYSLOG server).