Check: SRG-APP-000515-UEM-000390
Unified Endpoint Management Agent SRG:
SRG-APP-000515-UEM-000390
(in version v1 r0.1)
Title
The UEM server must, at a minimum, off-load audit logs of interconnected systems in real time and off-load standalone systems weekly. (Cat II impact)
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Check Content
Verify the UEM server, at a minimum, off-loads audit logs of interconnected systems in real time and off-load standalone systems weekly. If the UEM server does not off-load audit logs of interconnected systems in real time and off-load standalone systems weekly, this is a finding.
Fix Text
Configure the UEM server to, at a minimum, off-load audit logs of interconnected systems in real time and off-load standalone systems weekly.
Additional Identifiers
Rule ID: SRG-APP-000515-UEM-000390_rule
Vulnerability ID: SRG-APP-000515-UEM-000390
Group Title: SRG-APP-000515-UEM-000390
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001851 |
Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging. |
Controls
| Number | Title |
|---|---|
| AU-4(1) |
Transfer to Alternate Storage |