STIGQter STIGQter: STIG Summary: IBM DataPower ALG Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Jan 2016:

The DataPower Gateway must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

DISA Rule

SV-79699r1_rule

Vulnerability Number

V-65209

Group Title

SRG-NET-000088-ALG-000054

Rule Version

WSDP-AG-000026

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Audit logging may be interrupted due to insufficient memory and/or insufficient disk space to write logs. IBM DataPower Gateway appliances will monitor system resources and generate appropriate event codes in such cases. The relevant event codes are: 0x00330034, 0x01a40001, 0x01a30002, 0x01a30003, 0x01a40005, 0x01a30006, 0x01a30014, 0x01a30015, 0x01a30017 (Privileged account user log on to default domain >> Administration >> Debug >> "View List of Event Codes").

A Log Target can be configured to generate notifications (e.g., SNMP, SMTP) in the event that any of these event codes are detected.

Privileged account user log on to default domain >> Administration >> Miscellaneous >> "Manage Log Targets" >> Click the "Add" button >> Name: "logTargetSystemResources" >> Target Type: select the desired notification mechanism (e.g., SNMP, SMTP) >> Log Format: Select a desired log format (e.g., text) >> Fixed Format: off >> Rate Limit: Specify an alert rate limit (default is 100/second) >> Feedback Detection: on >> Identical Event Detection: off >> Provide any additional required configuration specific to the Target Type (e.g., SMTP) >> Click the "Event Filters" tab >> Under "Event Subscriptions", add the following event codes: 0x00330034, 0x01a40001, 0x01a30002, 0x01a30003, 0x01a40005, 0x01a30006, 0x01a30014, 0x01a30015, 0x01a30017 >> Click the "Apply" button >> Click "Save Configuration".

Check Contents

Administration >> Miscellaneous >> "Manage Log Targets" >> Click the appropriate log target (e.g., "logTargetSystemResources" >> Click the "Event Filters" tab >> Confirm subscriptions to the following event codes: 0x00330034, 0x01a40001, 0x01a30002, 0x01a30003, 0x01a40005, 0x01a30006, 0x01a30014, 0x01a30015, 0x01a30017.

If any of these codes are not subscribed to, this is a finding.

Vulnerability Number

V-65209

Documentable

False

Rule Version

WSDP-AG-000026

Severity Override Guidance

Administration >> Miscellaneous >> "Manage Log Targets" >> Click the appropriate log target (e.g., "logTargetSystemResources" >> Click the "Event Filters" tab >> Confirm subscriptions to the following event codes: 0x00330034, 0x01a40001, 0x01a30002, 0x01a30003, 0x01a40005, 0x01a30006, 0x01a30014, 0x01a30015, 0x01a30017.

If any of these codes are not subscribed to, this is a finding.

Check Content Reference

M

Target Key

2859

Comments