STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

Forescout must generate a critical alert to be sent to the Information System Security Officer (ISSO) and Systems Administrator (SA) (at a minimum) in the event of an audit processing failure. This is required for compliance with C2C Step 1.

DISA Rule

SV-233325r1113798_rule

Vulnerability Number

V-233325

Group Title

SRG-NET-000335-NAC-001360

Rule Version

FORE-NC-000170

Severity

CAT II

CCI(s)

• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Log on to the Forescout UI.

1. Locate the audit process policies as identified by the site representative.
2. Configure a policy for audit failure to include the notification of security personnel. This could also include sending a balloon message, notification, or email as follows.
a. Navigate to Options >> General >> Mail and DNS.
b. Configure the appropriate Operator Email and mail relay information to ensure alerts and notifications are being sent to the appropriate people.
c. Additionally, ensure that any policies that need notification actions have one of the following actions configured:
- Send Email.
- Send Email to User.
- Send Balloon Notification.
- HTTP Notification.
- Splunk: Send Update from CounterACT.

Check Contents

If DOD is not at C2C Step 1 or higher, this is not a finding.

Verify Forescout sends an alert to the proper security personnel when an audit process failure occurs.

1. Log on to the Forescout UI.
2. Locate the audit process policies as identified by the site representative.
3. Verify a policy for "audit failure" exists.
4. Verify this policy includes notification of security personnel as follows.
a. Navigate to Options >> General >> Mail and DNS.
b. Verify the configuration of the appropriate Operator Email and mail relay information to ensure alerts and notifications are being sent to the appropriate people.
c. Verify that any policies that need notification actions have one of the following actions configured:
- Send Email.
- Send Email to User.
- Send Balloon Notification.
- HTTP Notification.
- Splunk: Send Update from CounterACT.

If Forescout does not send an alert when an audit processing failure occurs, this is a finding.

Vulnerability Number

V-233325

Documentable

False

Rule Version

FORE-NC-000170

Severity Override Guidance

If DOD is not at C2C Step 1 or higher, this is not a finding.

Verify Forescout sends an alert to the proper security personnel when an audit process failure occurs.

1. Log on to the Forescout UI.
2. Locate the audit process policies as identified by the site representative.
3. Verify a policy for "audit failure" exists.
4. Verify this policy includes notification of security personnel as follows.
a. Navigate to Options >> General >> Mail and DNS.
b. Verify the configuration of the appropriate Operator Email and mail relay information to ensure alerts and notifications are being sent to the appropriate people.
c. Verify that any policies that need notification actions have one of the following actions configured:
- Send Email.
- Send Email to User.
- Send Balloon Notification.
- HTTP Notification.
- Splunk: Send Update from CounterACT.

If Forescout does not send an alert when an audit processing failure occurs, this is a finding.

Check Content Reference

M

Target Key

5250