Free DISA STIG and SRG Library | Vaulted

V-55325

The IDPS must off-load log records to a centralized log server.

Finding ID
SRG-NET-000334-IDPS-00191
Rule ID
SV-69571r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000334-IDPS-00191
CCI
CCI-001851
Target Key
(None)
Documentable
No
Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

Fix Text

Configure the IDPS to off-load log records to a centralized log server.

Check Content

Verify the IDPS off-loads log records to a centralized log server. If the IDPS does not off-load log records to a centralized log server, this is a finding.