In the event of a logging failure caused by the lack of audit record storage capacity, the Palo Alto Networks security platform must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207691	PANW-IP-000010	SV-207691r557390_rule		Medium

Description
It is critical that when the Palo Alto Networks security platform is at risk of failing to process audit logs as required, it takes action to mitigate the failure. The Palo Alto Networks security platform performs a critical security function, so its continued operation is imperative. Since availability of the Palo Alto Networks security platform is an overriding concern, shutting down the system in the event of an audit failure should be avoided, except as a last resort.

Description

It is critical that when the Palo Alto Networks security platform is at risk of failing to process audit logs as required, it takes action to mitigate the failure. The Palo Alto Networks security platform performs a critical security function, so its continued operation is imperative. Since availability of the Palo Alto Networks security platform is an overriding concern, shutting down the system in the event of an audit failure should be avoided, except as a last resort.

STIG	Date
Palo Alto Networks IDPS Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-7945r358406_chk )
Note: overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform. Go to Device >> Setup In the "Logging and Reporting Settings" pane, if the "Stop Traffic when LogDb Full" checkbox is selected, this is a finding.

Fix Text (F-7945r358407_fix)
Note: Overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform. Go to Device >> Setup In the "Logging and Reporting Settings" pane, select the "Edit" icon in the upper-right corner. In the "Logging and Reporting Settings" window, in the "Log Export and Reporting" tab, deselect (uncheck) the "Stop Traffic when LogDb Full" checkbox. If it is already not selected, do not change it. Switch back to the "Log Storage" tab. Select "OK". If no changes were made, it is not necessary or possible to commit a change. If a change was made, commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

Fix Text (F-7945r358407_fix)

Note: Overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform.

Go to Device >> Setup
In the "Logging and Reporting Settings" pane, select the "Edit" icon in the upper-right corner.
In the "Logging and Reporting Settings" window, in the "Log Export and Reporting" tab, deselect (uncheck) the "Stop Traffic when LogDb Full" checkbox. If it is already not selected, do not change it.
Switch back to the "Log Storage" tab.
Select "OK".

If no changes were made, it is not necessary or possible to commit a change. If a change was made, commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.