Check: FORE-NC-000160
Forescout Network Access Control STIG:
FORE-NC-000160
(in versions v1 r2 through v1 r1)
Title
Forescout must off-load log records onto a different system. (Cat II impact)
Discussion
Having a separate, secure location for log records is essential to the preservation of logs as required by policy.
Check Content
1. Go to Tools >> Options >> Syslog. 2. Verify a syslog server's IP address is configured. If each Forescout device does not offload log records to a separate device, this is a finding.
Fix Text
Configure Syslog server with TCP, as well as configure Syslog to alert if the communication between the Syslog server and the Forescout appliance loses connectivity. 1. Go to Tools >> Options >> Syslog. 2. Click Add/Edit. 3. Configure the Syslog: - Syslog Server IP address - Server Port - Server Protocol set to TCP - Check the Use TLS setting - Configure the Identity, Facility, and Severity. 4. Click "Ok". 5. Click "Apply".
Additional Identifiers
Rule ID: SV-233324r611394_rule
Vulnerability ID: V-233324
Group Title: SRG-NET-000334-NAC-001350
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001851 |
The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited. |
Controls
Number | Title |
---|---|
AU-4 (1) |
Transfer To Alternate Storage |