The Tanium application must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-254933	SRG-APP-000357	TANS-AP-000860	SV-254933r1067722_rule	2025-02-11	2

Description
To ensure applications have a sufficient storage capacity in which to write the audit logs, applications need to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of the application and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both.

Description

To ensure applications have a sufficient storage capacity in which to write the audit logs, applications need to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of the application and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both.

ℹ️ Check
1. Access the TanOS interactively. 2. Press "A" for "Appliance Configuration Menu," and then press "Enter". 3. Press "4" for "Syslog Configuration," and then press "Enter". 4. Press "1" for "Check current status," and then press "Enter". If the syslog status page states "No existing TanOS syslog forwarding configuration found" this is a finding. If the syslog status page states "Syslog forwarding configuration" and the SIEM administrator verifies SIEM is receiving the events correctly and generating notifications for low free disk space, this is not a finding.

ℹ️ Check

1. Access the TanOS interactively. 2. Press "A" for "Appliance Configuration Menu," and then press "Enter". 3. Press "4" for "Syslog Configuration," and then press "Enter". 4. Press "1" for "Check current status," and then press "Enter". If the syslog status page states "No existing TanOS syslog forwarding configuration found" this is a finding. If the syslog status page states "Syslog forwarding configuration" and the SIEM administrator verifies SIEM is receiving the events correctly and generating notifications for low free disk space, this is not a finding.

✔️ Fix
1. Access the TanOS interactively. 2. Press "A" for "Appliance Configuration Menu," and then press "Enter". 3. Press "4" for "Syslog Configuration," and then press "Enter". 4. Press "5" for "Configure syslog forwarding," and then press "Enter". 5. Enter the destination host (IP address or hostname) provided by the SIEM administrator, and then press "Enter". 6. Enter the destination port number and press "Enter". 7. If TLS is required for this syslog destination, enter "Yes", otherwise enter "No", and press "Enter". 8. Enter the destination protocol, "udp" or "tcp", and press "Enter". 9. Work with the SIEM administrator to validate events are being received, and to configure notifications for low free disk space.

✔️ Fix

1. Access the TanOS interactively. 2. Press "A" for "Appliance Configuration Menu," and then press "Enter". 3. Press "4" for "Syslog Configuration," and then press "Enter". 4. Press "5" for "Configure syslog forwarding," and then press "Enter". 5. Enter the destination host (IP address or hostname) provided by the SIEM administrator, and then press "Enter". 6. Enter the destination port number and press "Enter". 7. If TLS is required for this syslog destination, enter "Yes", otherwise enter "No", and press "Enter". 8. Enter the destination protocol, "udp" or "tcp", and press "Enter". 9. Work with the SIEM administrator to validate events are being received, and to configure notifications for low free disk space.