Check: AMLS-NM-000400
Arista MLS DCS-7000 Series NDM STIG:
AMLS-NM-000400
(in versions v1 r3 through v1 r2)
Title
The Arista Multilayer Switch must, at a minimum, off-load audit records for interconnected systems in real time. (Cat II impact)
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Check Content
Check the network device configuration to determine if the device off-loads audit records onto a different system or media than the system being audited. If the device does not off-load audit records onto a different system or media, this is a finding. Review the configuration for the "logging host [a.b.c.d]" statement. Execute a "show logging" to verify logging host status.
Fix Text
Configure the network device to off-load interconnected systems in real time and off-load standalone systems weekly. Arista EOS logs can be exported to, including by a regular syslog server. Configuration Example: switch(config)#logging host[ a.b.c.d] switch(config)#logging trap informational
Additional Identifiers
Rule ID: SV-75339r1_rule
Vulnerability ID: V-60881
Group Title: SRG-APP-000515-NDM-000325
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001851 |
The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited. |
Controls
Number | Title |
---|---|
AU-4 (1) |
Transfer To Alternate Storage |