The Dell OS10 Switch must generate an immediate real-time alert of all audit failure events requiring real-time alerts.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-269791 | SRG-APP-000360-NDM-000295 | OS10-NDM-000670 | SV-269791r1051758_rule | 2024-12-11 | 1 |
| Description |
|---|
| It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Satisfies: SRG-APP-000360-NDM-000295, SRG-APP-000795-NDM-000130 |
| ℹ️ Check |
|---|
| Determine if the OS10 Switch generates an immediate alert of all audit failure events requiring real-time alerts. Verify that syslog is configured to use a connection-based protocol, either TCP or TLS, when connecting to a remote syslog server: OS10# show running-configuration logging ! ... logging server 100.94.75.111 tcp 514 If the OS10 Switch is not configured to use either TCP or TLS for connection to the remote syslog servers, this is a finding. |
| ✔️ Fix |
|---|
| Configure the OS10 Switch to use either TCP or TLS for connection to the remote syslog servers: OS10(config)# logging server 100.94.75.111 tcp |