STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The Sentry must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

DISA Rule

SV-251021r1028187_rule

Vulnerability Number

V-251021

Group Title

SRG-NET-000088-ALG-000054

Rule Version

MOIS-AL-000260

Severity

CAT III

CCI(s)

• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

10

Fix Recommendation

Configure the Sentry to send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Configure "Send Notifications" to enabled.
4. Configure an email list containing the ISSM and SCA in the Email List.
5. Configure "Alert Notification Management" section is set to meet organizational requirements.

Refer to the Sentry 9.8.0 Guide "Configuring Sentry alert notifications" section for more information.

Check Contents

Verify the Sentry sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Verify "Send Notifications" is enabled.
4. Verify an email list containing the ISSM and SCA is input in the Email List.
5. Verify "Alert Notification Management" section is set to meet organizational requirements.

If the "Alert Notification Management" section is not set to meet organizational requirements, this is a finding.

Vulnerability Number

V-251021

Documentable

False

Rule Version

MOIS-AL-000260

Severity Override Guidance

Verify the Sentry sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Verify "Send Notifications" is enabled.
4. Verify an email list containing the ISSM and SCA is input in the Email List.
5. Verify "Alert Notification Management" section is set to meet organizational requirements.

If the "Alert Notification Management" section is not set to meet organizational requirements, this is a finding.

Check Content Reference

M

Target Key

5439