Check: TIPP-NM-000390
Trend Micro TippingPoint NDM STIG:
TIPP-NM-000390
(in versions v2 r2 through v1 r1)
Title
The Trend Micro SMS must generate an alert for all audit failure events requiring real-time alerts. (Cat II impact)
Discussion
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).
Check Content
In the SMS client, ensure a SNMPv3 trap destination is configured. 1. Navigate to Admin >> Server Properties >> SNMP. 2. View the NMS configuration. If an NMS Trap Destination is not configured, this is a finding.
Fix Text
In the SMS client, configure a SNMPv3 trap destination is configured. Audit failure alerts are generated via SNMPv3 traps. 1. Navigate to Admin >> Server Properties >> SNMP >> Add. 2. Enter the IPv4 or IPv6 address, Version 3, with the username, and authPriv keys configured that match the site's required attributes.
Additional Identifiers
Rule ID: SV-242245r961401_rule
Vulnerability ID: V-242245
Group Title: SRG-APP-000360-NDM-000295
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001858 |
Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur. |
Controls
Number | Title |
---|---|
AU-5(2) |
Real-time Alerts |