The IDPS must send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-206891 | SRG-NET-000249 | SRG-NET-000249-IDPS-00222 | SV-206891r383131_rule | 2024-12-05 | 3 |
| Description |
|---|
| Without an alert, security personnel may be unaware of an impending failure of the audit capability, and the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The IDPS generates an immediate (within seconds) alert which notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. |
| ℹ️ Check |
|---|
| Verify the IDPS sends an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected. If the IDPS does not send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected, this is a finding. |
| ✔️ Fix |
|---|
| Configure the IDPS to send an immediate (within seconds) alert to, at a minimum, the system administrator when malicious code is detected. |