The network device must generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-55077	SRG-APP-000359-NDM-000294	SV-69323r1_rule		Medium

Description
If security personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. This could lead to the loss of audit information. Note that while the network device must generate the alert, notification may be done by a management server.

STIG	Date
Network Device Management Security Requirements Guide	2017-12-28

Details

Check Text ( C-55699r1_chk )
Determine if the network device generates an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity. This requirement may be verified by configuration review or validated test results. If an immediate alert is not generated when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity, this is a finding.

Check Text ( C-55699r1_chk )

Determine if the network device generates an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

This requirement may be verified by configuration review or validated test results.

If an immediate alert is not generated when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity, this is a finding.

Fix Text (F-59943r1_fix)
Configure the network device to generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.