STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

Forescout must configure TCP for the syslog protocol to allow for detection by the central event server if communications is lost. This is required for compliance with C2C Step 1.

DISA Rule

SV-233329r811408_rule

Vulnerability Number

V-233329

Group Title

SRG-NET-000088-NAC-000440

Rule Version

FORE-NC-000230

Severity

CAT II

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

10

Fix Recommendation

Configure Syslog server with TCP, as well as configure Syslog to alert if the communication between the Syslog server and the Forescout appliance loses connectivity.

1. Go to Tools >> Options >> Syslog.
2. Click Add/Edit.
3. Configure the Syslog:
- Syslog Server IP address
- Server Port
- Server Protocol set to TCP
- Check the Use TLS setting
- Configure the Identity, Facility, and Severity.
4. Click "OK".
5. Click "Apply".

Check Contents

If DoD is not at C2C Step 1 or higher, this is not a finding.

1. Go to Tools >> Options >> Syslog.
2. Verify the Server Protocol is set to TCP.
3. Verify "Use TLS" setting is set.
4. Verify the "Identity, Facility, and Severity" setting is configured.

If Forescout does not use TCP for the syslog protocol, this is a finding.

Vulnerability Number

V-233329

Documentable

False

Rule Version

FORE-NC-000230

Severity Override Guidance

If DoD is not at C2C Step 1 or higher, this is not a finding.

1. Go to Tools >> Options >> Syslog.
2. Verify the Server Protocol is set to TCP.
3. Verify "Use TLS" setting is set.
4. Verify the "Identity, Facility, and Severity" setting is configured.

If Forescout does not use TCP for the syslog protocol, this is a finding.

Check Content Reference

M

Target Key

5250