STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The Sentry must reveal error messages only to the ISSO, ISSM, and SCA.

DISA Rule

SV-251035r1028201_rule

Vulnerability Number

V-251035

Group Title

SRG-NET-000402-ALG-000130

Rule Version

MOIS-AL-001200

Severity

CAT III

CCI(s)

• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

Configure the Sentry to reveal error messages only to the ISSO, ISSM, and SCA.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Enable "Send Notifications".
4. Configure an email list containing the ISSO, ISSM, and SCA in the Email List.
5. Configure the "Alert Notification Management" section to meet organizational requirements.

Check Contents

Verify the Sentry reveals error messages only to the ISSO, ISSM, and SCA.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Verify "Send Notifications" is enabled.
4. Verify an email list containing the ISSO, ISSM, and SCA is input in the Email List.
5. Verify the "Alert Notification Management" section is set to meet organizational requirements.

If Sentry is not configured to reveal error messages only to the ISSO, ISSM, and SCA, this is a finding.

Vulnerability Number

V-251035

Documentable

False

Rule Version

MOIS-AL-001200

Severity Override Guidance

Verify the Sentry reveals error messages only to the ISSO, ISSM, and SCA.

1. Log in to Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Verify "Send Notifications" is enabled.
4. Verify an email list containing the ISSO, ISSM, and SCA is input in the Email List.
5. Verify the "Alert Notification Management" section is set to meet organizational requirements.

If Sentry is not configured to reveal error messages only to the ISSO, ISSM, and SCA, this is a finding.

Check Content Reference

M

Target Key

5439