Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-42611 | DTASEP003 | SV-55339r1_rule | Medium |
Description |
---|
Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems. Logs are also useful when performing auditing and forensic analysis, supporting internal investigations, establishing baselines, and identifying operational trends and long-term problems. (FISMA 800-92) |
STIG | Date |
---|---|
Symantec Endpoint Protection 12.1 Managed Client Antivirus | 2014-07-03 |
Check Text ( C-48892r1_chk ) |
---|
Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Advanced Options -> Select Miscellaneous -> Select the Log Handling tab -> Under Log Retention -> Ensure "Delete logs older than" is set to 30 days or greater. Criteria: If "Delete logs older than" is not set to 30 days or greater, this is a finding. On the client machine use the Windows Registry Editor to navigate to the following key: 32 bit: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV 64 bit: HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV Criteria: If the value data for the LogFileRollOverDays values is not 1e (the hex value for 30) or higher, this is a finding. |
Fix Text (F-48193r1_fix) |
---|
From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click on the applied policy -> Under Windows Settings, Advanced Options -> Select Miscellaneous -> Select the Log Handling tab -> Under Log Retention -> Set "Delete logs older than" to 30 days or greater. |