The Syslog client must use TCP connections.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-271027	SRG-APP-000383	DRAG-OT-001630	SV-271027r1057724_rule	2024-12-23	1

Description
Removal of unneeded or nonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources. The organization must perform a periodic scan/review of Dragos (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or nonsecure.

ℹ️ Check
Use the netstat command to display active UDP connections: netstat -n -p UDP If the syslog client is using a UDP connection, this is a finding.

✔️ Fix
Changing UDP ports to TCP ports and using TCP instead involves modifying the configuration of the application or service that uses UDP for communication. Modify the syslog client configuration to specify TCP instead of UDP. This may involve changing port numbers or selecting TCP as the communication protocol. After making the necessary changes, restart the application or service to apply the new configuration settings. This ensures that the syslog client starts using TCP ports instead of UDP ports.

✔️ Fix

Changing UDP ports to TCP ports and using TCP instead involves modifying the configuration of the application or service that uses UDP for communication. Modify the syslog client configuration to specify TCP instead of UDP. This may involve changing port numbers or selecting TCP as the communication protocol. After making the necessary changes, restart the application or service to apply the new configuration settings. This ensures that the syslog client starts using TCP ports instead of UDP ports.