Navigate

Check: SRG-NET-000334-IDPS-00191

Intrusion Detection and Prevention Systems (IDPS) SRG: SRG-NET-000334-IDPS-00191 (in versions v2 r6 through v2 r2)

Title

The IDPS must off-load log records to a centralized log server. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

Check Content

Verify the IDPS off-loads log records to a centralized log server. If the IDPS does not off-load log records to a centralized log server, this is a finding.

Fix Text

Configure the IDPS to off-load log records to a centralized log server.

Additional Identifiers

Rule ID: SV-69571r1_rule

Vulnerability ID: V-55325

Group Title: SRG-NET-000334-IDPS-00191

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001851	The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-4 (1)	Transfer To Alternate Storage