STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur.

DISA Rule

SV-234173r961812_rule

Vulnerability Number

V-234173

Group Title

SRG-APP-000499-NDM-000319

Rule Version

FGFW-ND-000070

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

When Event Logging is enabled, the device will audit attempts to delete administrator privileges. To enable event logging, log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:

# config log eventfilter
# set event enable
# set system enable
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log eventfilter | grep -i 'event\|system'

The output should be:
set event enable
set system enable

If the event and system parameters are set to disable, this is a finding.

Vulnerability Number

V-234173

Documentable

False

Rule Version

FGFW-ND-000070

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log eventfilter | grep -i 'event\|system'

The output should be:
set event enable
set system enable

If the event and system parameters are set to disable, this is a finding.

Check Content Reference

M

Target Key

5260