STIGQter: STIG Summary: Ivanti Sentry 9.x NDM Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

Sentry must offload audit records onto a different system or media than the system being audited.

DISA Rule

SV-251002r1028240_rule

Vulnerability Number

V-251002

Group Title

SRG-APP-000515-NDM-000325

Rule Version

MOIS-ND-000900

Severity

CAT III

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Configure Sentry to forward/offload audit to a different system.

1. Log in to Sentry.
2. Go to Settings >> Syslog.
3. Configure a new syslog server if not already added.
4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit".
5. Set the Admin State to "Enable".
6. Click "Apply".

Check Contents

Verify Sentry is configured to offload audit records to a different system.

1. Log in to Sentry.
2. Go to Settings >> Syslog.
3. Verify that a syslog server is configured.

If the syslog server is not configured, this is a finding.

Vulnerability Number

V-251002

Documentable

False

Rule Version

MOIS-ND-000900

Severity Override Guidance

Verify Sentry is configured to offload audit records to a different system.

1. Log in to Sentry.
2. Go to Settings >> Syslog.
3. Verify that a syslog server is configured.

If the syslog server is not configured, this is a finding.

Check Content Reference

M

Target Key

5438