STIGQter: STIG Summary: Trend Micro TippingPoint IDPS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The TPS must provide audit record generation capability for events where communication traffic is blocked or restricted based on policy filters, rules, signatures, and anomaly analysis.

DISA Rule

SV-242177r710074_rule

Vulnerability Number

V-242177

Group Title

SRG-NET-000113-IDPS-00082

Rule Version

TIPP-IP-000110

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

10

Fix Recommendation

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".
4. Under "Filter criteria", select all "Filter categories". Select the "Additional Criteria" section.
5. Uncheck "permit" and "rate limit", then click "Search".
6. Once the results are presented, click the "Action Set" column to filter by action type. If any items state "Block":
a. Double-click the item.
b. Click the radio button for "User Filter settings".
c. On the drop down-menu, select "Block + Notify".
d. Click "OK".
e. Once under an approved change window, click distribute and send the updated policy to all TPS systems and managed segment-groups.
f. Ensure progress completes at 100%.

Check Contents

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".
4. Under "Filter criteria", select all "Filter categories". Select the "Additional Criteria" section.
5. Uncheck "permit" and "rate limit", then click Search.
6. Once the results are presented, check the "Action Set" column to filter by action type.

If any items state "Block" but not "Block/Notify", this is a finding.

Vulnerability Number

V-242177

Documentable

False

Rule Version

TIPP-IP-000110

Severity Override Guidance

1. In the Trend Micro SMS, navigate to "Profiles" and "Inspection Profiles" and select the organization's profile.
2. If there is not one configured, select "Default".
3. Click "Search".
4. Under "Filter criteria", select all "Filter categories". Select the "Additional Criteria" section.
5. Uncheck "permit" and "rate limit", then click Search.
6. Once the results are presented, check the "Action Set" column to filter by action type.

If any items state "Block" but not "Block/Notify", this is a finding.

Check Content Reference

M

Target Key

5367