STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts.

DISA Rule

SV-239923r991812_rule

Vulnerability Number

V-239923

Group Title

SRG-APP-000360-NDM-000295

Rule Version

CASA-ND-000930

Severity

CAT II

CCI(s)

• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
• CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Weight

10

Fix Recommendation

Configure the Cisco ASA to send critical to emergency log messages to the syslog server as shown in the example below.

ASA(config)# logging host NDM_INTERFACE 10.1.48.10
ASA(config)# logging trap critical
ASA(config)# end

Note: The parameter critical can replaced with a lesser severity (i.e., error, warning, notice, informational).

Check Contents

Review the Cisco ASA configuration to verify it is compliant with this requirement as shown in the example below.

logging trap critical
logging host NDM_INTERFACE 10.1.48.10

Note: The parameter critical can replaced with a lesser severity (i.e., error, warning, notice, informational). A logging list can be used as an alternative to the severity level.

If the Cisco ASA is not configured to generate an alert for all audit failure events, this is a finding.

Vulnerability Number

V-239923

Documentable

False

Rule Version

CASA-ND-000930

Severity Override Guidance

Review the Cisco ASA configuration to verify it is compliant with this requirement as shown in the example below.

logging trap critical
logging host NDM_INTERFACE 10.1.48.10

Note: The parameter critical can replaced with a lesser severity (i.e., error, warning, notice, informational). A logging list can be used as an alternative to the severity level.

If the Cisco ASA is not configured to generate an alert for all audit failure events, this is a finding.

Check Content Reference

M

Target Key

5342