STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

Forescout must off-load log records onto a different system.

DISA Rule

SV-233324r611394_rule

Vulnerability Number

V-233324

Group Title

SRG-NET-000334-NAC-001350

Rule Version

FORE-NC-000160

Severity

CAT II

CCI(s)

• CCI-001851 - The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Weight

10

Fix Recommendation

Configure Syslog server with TCP, as well as configure Syslog to alert if the communication between the Syslog server and the Forescout appliance loses connectivity.

1. Go to Tools >> Options >> Syslog.
2. Click Add/Edit.
3. Configure the Syslog:
- Syslog Server IP address
- Server Port
- Server Protocol set to TCP
- Check the Use TLS setting
- Configure the Identity, Facility, and Severity.
4. Click "Ok".
5. Click "Apply".

Check Contents

1. Go to Tools >> Options >> Syslog.
2. Verify a syslog server's IP address is configured.

If each Forescout device does not offload log records to a separate device, this is a finding.

Vulnerability Number

V-233324

Documentable

False

Rule Version

FORE-NC-000160

Severity Override Guidance

1. Go to Tools >> Options >> Syslog.
2. Verify a syslog server's IP address is configured.

If each Forescout device does not offload log records to a separate device, this is a finding.

Check Content Reference

M

Target Key

5250

Comments