STIGQter: STIG Summary: IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The MQ Appliance network device must generate an immediate alert when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.

DISA Rule

SV-89667r1_rule

Vulnerability Number

V-74993

Group Title

SRG-APP-000359-NDM-000294

Rule Version

MQMH-ND-001040

Severity

CAT II

CCI(s)

• CCI-001855 - The information system provides a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit record storage volume reaches an organization-defined percentage of repository maximum audit record storage capacity.
• CCI-001858 - The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Log on to the MQ Appliance CLI as a privileged user.

To enter global configuration mode, enter "config".

To create a syslog target, enter:
logging target <logging target name>
type syslog
admin-state enabled
local-address <MQ Appliance IP>
remote-address <syslog server IP>
remote-port <syslog server port>
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error
exit
write mem
y

At the syslog server, set up event notification triggers for the following event codes: 0x80c0006a, 0x82400067, 0x00330034, 0x80400080.

Set up notifications to immediately alert when audit record storage utilization exceeds 75% of storage capacity.

Check Contents

Log on to the MQ Appliance CLI as a privileged user.

Enter:
co
show logging target

All configured logging targets will be displayed. Verify:
- This list includes a remote syslog notification target; and
- It includes all desired log event source and log level parameters:
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error

Ask the system admin to provide evidence the following alert triggers have been set up:
0x80c0006a, 0x82400067, 0x00330034, 0x80400080.

Verify alerts are immediately sent when syslog storage capacity reaches 75% of maximum audit record storage capacity.

If any is not true, this is a finding.

Vulnerability Number

V-74993

Documentable

False

Rule Version

MQMH-ND-001040

Severity Override Guidance

Log on to the MQ Appliance CLI as a privileged user.

Enter:
co
show logging target

All configured logging targets will be displayed. Verify:
- This list includes a remote syslog notification target; and
- It includes all desired log event source and log level parameters:
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error

Ask the system admin to provide evidence the following alert triggers have been set up:
0x80c0006a, 0x82400067, 0x00330034, 0x80400080.

Verify alerts are immediately sent when syslog storage capacity reaches 75% of maximum audit record storage capacity.

If any is not true, this is a finding.

Check Content Reference

M

Target Key

3243

Comments