STIGQter: STIG Summary: Trend Micro TippingPoint IDPS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

In the event of a logging failure caused by the lack of audit record storage capacity, the SMS must continue generating and storing audit records, overwriting the oldest audit records in a first-in-first-out manner using Audit Log maintenance.

DISA Rule

SV-242186r710101_rule

Vulnerability Number

V-242186

Group Title

SRG-NET-000089-IDPS-00069

Rule Version

TIPP-IP-000200

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

10

Fix Recommendation

1. In the Trend Micro SMS interface, go to the "Admin" tab, and select "Database".
2. Make the following changes:
a. The Events log must be set to at least 30,000,000 rows, with an age of 90 days.
b. The Audit Log must be set 1,000,000 rows and an age of 365 days.
c. The Device Audit Log must be set 1,000,000 rows and an age of 365 days.
d. The Device System Log must be set 1,000,000 rows and an age of 365 days.

Check Contents

1. In the Trend Micro SMS interface, go to the "Admin" tab, and select "Database". Each item in the database maintenance section has a configurable item to ensure when the newest logs will overwrite the oldest logs. This is configured through the number of rows:
a. The Events log must be set to at least 30,000,000 rows, with an age of 90 days.
b. The Audit Log must be set 1,000,000 rows and an age of 365 days.
c. The Device Audit Log must be set 1,000,000 rows and an age of 365 days.
d. The Device System Log must be set 1,000,000 rows and an age of 365 days.

If these values are not set, this is a finding.

Vulnerability Number

V-242186

Documentable

False

Rule Version

TIPP-IP-000200

Severity Override Guidance

1. In the Trend Micro SMS interface, go to the "Admin" tab, and select "Database". Each item in the database maintenance section has a configurable item to ensure when the newest logs will overwrite the oldest logs. This is configured through the number of rows:
a. The Events log must be set to at least 30,000,000 rows, with an age of 90 days.
b. The Audit Log must be set 1,000,000 rows and an age of 365 days.
c. The Device Audit Log must be set 1,000,000 rows and an age of 365 days.
d. The Device System Log must be set 1,000,000 rows and an age of 365 days.

If these values are not set, this is a finding.

Check Content Reference

M

Target Key

5367