STIGQter: STIG Summary: Palo Alto Networks IDPS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

In the event of a logging failure caused by the lack of audit record storage capacity, the Palo Alto Networks security platform must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.

DISA Rule

SV-207691r557390_rule

Vulnerability Number

V-207691

Group Title

SRG-NET-000089-IDPS-00069

Rule Version

PANW-IP-000010

Severity

CAT II

CCI(s)

• CCI-000140 - The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

Weight

10

Fix Recommendation

Note: Overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform.

Go to Device >> Setup
In the "Logging and Reporting Settings" pane, select the "Edit" icon in the upper-right corner.
In the "Logging and Reporting Settings" window, in the "Log Export and Reporting" tab, deselect (uncheck) the "Stop Traffic when LogDb Full" checkbox. If it is already not selected, do not change it.
Switch back to the "Log Storage" tab.
Select "OK".

If no changes were made, it is not necessary or possible to commit a change. If a change was made, commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

Check Contents

Note: overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform.

Go to Device >> Setup
In the "Logging and Reporting Settings" pane, if the "Stop Traffic when LogDb Full" checkbox is selected, this is a finding.

Vulnerability Number

V-207691

Documentable

False

Rule Version

PANW-IP-000010

Severity Override Guidance

Note: overwriting the oldest audit records in a first-in-first-out manner is the default setting of the Palo Alto Networks security platform.

Go to Device >> Setup
In the "Logging and Reporting Settings" pane, if the "Stop Traffic when LogDb Full" checkbox is selected, this is a finding.

Check Content Reference

M

Target Key

2927

Comments