Check: TIPP-IP-000360
Trend Micro TippingPoint IDPS STIG:
TIPP-IP-000360
(in versions v2 r2 through v1 r1)
Title
The TPS must generate a log record so an alert can be configured to, at a minimum, the system administrator when malicious code is detected. (Cat I impact)
Discussion
Without an alert, security personnel may be unaware of an impending failure of the audit capability, and the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The TPS generates an immediate (within seconds) alert which notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. Satisfies: SRG-NET-000248-IDPS-00206, SRG-NET-000249-IDPS-00222, SRG-NET-000385-IDPS-00210
Check Content
1. In the Trend Micro SMS, navigate to "Profiles" and "Shared Settings". 2. Under "Action Sets, if "Remote Syslog", are not enabled for both the "Block+Notify" and "Block+Notify+Trace", this is a finding.
Fix Text
1. In the Trend Micro SMS, navigate to "Profiles" and "Shared Settings". 2. Under "Action Sets: a. Select "Block+Notify" and edit. b. Select Notifications, and check "Remote Syslog". c. Select "Finish".
Additional Identifiers
Rule ID: SV-242199r1018785_rule
Vulnerability ID: V-242199
Group Title: SRG-NET-000248-IDPS-00206
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001242 |
The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy. |
| CCI-001243 |
Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection. |
| CCI-002624 |
Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy. |
| CCI-002684 |
Audit and/or alert organization-defined personnel when unauthorized network services are detected. |