STIGQter: STIG Summary: SEL-2740S NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 02 May 2019:

The SEL-2740S must be configured to create log records for DoD-defined events.

DISA Rule

SV-102379r1_rule

Vulnerability Number

V-92291

Group Title

SRG-APP-000089-NDM-000221

Rule Version

SELS-ND-000230

Severity

CAT II

CCI(s)

• CCI-000169 - The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.

Weight

10

Fix Recommendation

To configure the SEL-2740S to send logs to Syslog servers do the following:
1. Log in with Permission Level 3 right into parent OTSDN Controller.
2. Go to the "Configuration Objects" settings page and select the desired switch for SEL-2740S node.
3. Insert the Syslog log service and configure the settings with the desired Server IP addresses into the Syslog settings fields.
4. Create the flow rules necessary for Syslog.

Check Contents

Ensure SEL-2740S Syslog servers are configured by doing the following:
1. Log in with Permission Level 3 rights into parent OTSDN Controller.
2. Go to the "Configuration Objects" page and select the switch.
3. Check Syslog Server IP addresses are in the settings fields configured for the log services.
4. Check Syslog flows exist and are accurate for the SEL-2740S DUT and additional neighbor devices' flows exist and are correct.

If the SEL-2740S is not configured with Syslog server entries to ensure auditability, this is a finding.

Vulnerability Number

V-92291

Documentable

False

Rule Version

SELS-ND-000230

Severity Override Guidance

Ensure SEL-2740S Syslog servers are configured by doing the following:
1. Log in with Permission Level 3 rights into parent OTSDN Controller.
2. Go to the "Configuration Objects" page and select the switch.
3. Check Syslog Server IP addresses are in the settings fields configured for the log services.
4. Check Syslog flows exist and are accurate for the SEL-2740S DUT and additional neighbor devices' flows exist and are correct.

If the SEL-2740S is not configured with Syslog server entries to ensure auditability, this is a finding.

Check Content Reference

M

Target Key

3383

Comments