The system must alert administrators on permission update operations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64035	VCWN-06-000050	SV-78525r1_rule		Medium

Description
If personnel are not notified of permission events, they will not be aware of possible unsecure situations.

STIG	Date
VMware vSphere vCenter Server Version 6 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-64787r1_chk )
From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions. Verify there is an alarm created to alert on permission changes. or From a PowerCLI command prompt while connected to the vCenter server run the following command: Get-AlarmDefinition \| Where {$_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "vim.event.PermissionUpdatedEvent"} \| Select Name,Enabled,@{N="EventTypeId";E={$_.ExtensionData.Info.Expression.Expression.EventTypeId}} If an alarm is not created to alert on permission update events, this is a finding.

Check Text ( C-64787r1_chk )

From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions. Verify there is an alarm created to alert on permission changes.

or

From a PowerCLI command prompt while connected to the vCenter server run the following command:

Get-AlarmDefinition | Where {$_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "vim.event.PermissionUpdatedEvent"} | Select Name,Enabled,@{N="EventTypeId";E={$_.ExtensionData.Info.Expression.Expression.EventTypeId}}

If an alarm is not created to alert on permission update events, this is a finding.

Fix Text (F-69965r1_fix)
From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions >> Right click in the empty space and select New Alarm. On the General tab provide an alarm name and description, Select vCenter for alarm type and "Monitor for specific events occurring on this object", check "Enable this alarm". On the Triggers tab click Add three triggers and in the event column enter "vim.event.PermissionAddedEvent", "vim.event.PermissionRemovedEvent", and "vim.event.PermissionUpdatedEvent" for the three triggers and click OK.

Fix Text (F-69965r1_fix)

From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions >> Right click in the empty space and select New Alarm. On the General tab provide an alarm name and description, Select vCenter for alarm type and "Monitor for specific events occurring on this object", check "Enable this alarm". On the Triggers tab click Add three triggers and in the event column enter "vim.event.PermissionAddedEvent", "vim.event.PermissionRemovedEvent", and "vim.event.PermissionUpdatedEvent" for the three triggers and click OK.