STIGQter: STIG Summary: Central Log Server Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 24 Jul 2020:

Where multiple log servers are installed in the enclave, each log server must be configured to aggregate log records to a central aggregation server or other consolidated events repository.

DISA Rule

SV-95825r1_rule

Vulnerability Number

V-81111

Group Title

SRG-APP-000086-AU-000390

Rule Version

SRG-APP-000086-AU-000390

Severity

CAT II

CCI(s)

• CCI-000174 - The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.

Weight

10

Fix Recommendation

Where multiple log servers are installed in the enclave, configure each log server to forward logs to a consolidated aggregation server.

Check Contents

Examine the network architecture and documentation.

If the log server being reviewed is one of multiple log servers in the enclave or on a network segment, verify that an aggregation server exists and that the log server under review is configured to send records received from the host and devices to the aggregation server or centralized SIEM/events sever.

Where multiple log servers are installed in the enclave, if each log server is not configured to send log records to a central aggregation server or other consolidated events repository, this is a finding.

Vulnerability Number

V-81111

Documentable

False

Rule Version

SRG-APP-000086-AU-000390

Severity Override Guidance

Examine the network architecture and documentation.

If the log server being reviewed is one of multiple log servers in the enclave or on a network segment, verify that an aggregation server exists and that the log server under review is configured to send records received from the host and devices to the aggregation server or centralized SIEM/events sever.

Where multiple log servers are installed in the enclave, if each log server is not configured to send log records to a central aggregation server or other consolidated events repository, this is a finding.

Check Content Reference

M

Target Key

3395

Comments