Navigate

Check: CSCO-NC-000200

Cisco ISE NAC STIG: CSCO-NC-000200 (in versions v1 r5 through v1 r3)

Title

The Cisco ISE must generate a critical alert to be sent to the ISSO and SA (at a minimum) in the event of an audit processing failure. This is required for compliance with C2C Step 1. (Cat II impact)

Discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without an alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Cisco ISE provides system alarms which notify the administrator when critical system condition occurs. Alarms are displayed in the Alarm dashlet. Administrators can configured the dashlet to receive notification of alarms through e-mail and/or syslog messages.

Check Content

If DoD is not at C2C Step 1 or higher, this is not a finding. Verify the Cisco ISE will notify one or more individuals when there is a Log Collection Error. From the Web Admin portal: 1. Choose Administration >> System >> Settings >> Alarm Settings. 2. Select "Log Collector Error" from the list of default alarms and click "Edit". 3. Verify that "Enable" is selected. 4. Select "Enter Multiple Emails Separated with Comma". 5. Verify one or more email addresses are configured. If "Log Collector Error" alarm type is not enabled or email addresses are not configured to receive the alert, this is a finding.

Fix Text

Configure Cisco ISE to notify one or more individuals when there is a Log Collection Error. From the Web Admin portal: 1. Choose Administration >> System >> Settings >> Alarm Settings. 2. Select "Log Collector Error" from the list of default alarms and click "Edit". 3. Select "Enable". 4. Select "Enter Multiple Emails Separated with Comma". 5. Configure email addresses of individuals and organizational accounts to be notified. 6. Click "Submit".

Additional Identifiers

Rule ID: SV-242594r855855_rule

Vulnerability ID: V-242594

Group Title: SRG-NET-000335-NAC-001360

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001858	The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-5 (2)	Real-Time Alerts