STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

Forescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost.

DISA Rule

SV-233329r615867_rule

Vulnerability Number

V-233329

Group Title

SRG-NET-000088-NAC-000440

Rule Version

FORE-NC-000230

Severity

CAT II

CCI(s)

• CCI-000139 - The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.

Weight

10

Fix Recommendation

Configure Syslog server with TCP, as well as configure Syslog to alert if the communication between the Syslog server and the Forescout appliance loses connectivity.

1. Go to Tools >> Options >> Syslog.
2. Click Add/Edit.
3. Configure the Syslog:
- Syslog Server IP address
- Server Port
- Server Protocol set to TCP
- Check the Use TLS setting
- Configure the Identity, Facility, and Severity.
4. Click "OK".
5. Click "Apply".

Check Contents

1. Go to Tools >> Options >> Syslog.
2. Verify the Server Protocol is set to TCP.
3. Verify "Use TLS" setting is set.
4. Verify the "Identity, Facility, and Severity" setting is configured.

If Forescout does not use TCP for the syslog protocol, this is a finding.

Vulnerability Number

V-233329

Documentable

False

Rule Version

FORE-NC-000230

Severity Override Guidance

1. Go to Tools >> Options >> Syslog.
2. Verify the Server Protocol is set to TCP.
3. Verify "Use TLS" setting is set.
4. Verify the "Identity, Facility, and Severity" setting is configured.

If Forescout does not use TCP for the syslog protocol, this is a finding.

Check Content Reference

M

Target Key

5250

Comments