Free DISA STIG and SRG Library | Vaulted

V-74005

The Cisco IOS XE router must off load audit records via syslog so the audit records can be backed up every seven days.

Finding ID
CISR-ND-000043
Rule ID
SV-88679r2_rule
Severity
Cat III
CCE
(None)
Group Title
SRG-APP-000125-NDM-000241
CCI
CCI-001348
Target Key
(None)
Documentable
No
Discussion

Protection of log data includes assuring log data is not accidentally lost or deleted. Regularly backing up audit records to a different system or onto separate media than the system being audited helps to assure, in the event of a catastrophic system failure, the audit records will be retained. This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.

Fix Text

Configure the Cisco IOS XE router to use syslog. The configuration should look similar to the example below: logging host 1.1.1.1

Check Content

Verify that the Cisco IOS XE router is configured to use syslog. The configuration should look similar to the example below: logging host 1.1.1.1 If syslog is not configured, this is a finding.