STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to capture all DOD auditable events.

DISA Rule

SV-255962r960891_rule

Vulnerability Number

V-255962

Group Title

SRG-APP-000095-NDM-000225

Rule Version

ARST-ND-000790

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Configure a logging level sufficient to capture all DOD auditable events.

switch(config)#logging buffered informational
switch(config)#logging trap informational

NOTE: Acceptable settings include debugging, informational, and notifications to adjust syslog server traffic impact. Setting to higher severity levels can cause necessary lower-level events to be missed.

Check Contents

Verify the Arista network device is configured to audit all DOD auditable events.

Verify the logging settings in the configuration file with the following example:

switch#sh running-config | section logging

logging buffered informational
logging trap informational

NOTE: Acceptable settings include debugging, informational, and notifications to adjust syslog server traffic impact. Setting to higher severity levels can cause necessary lower-level events to be missed.

If the Arista network device is not configured to audit all DOD auditable events, this is a finding.

Vulnerability Number

V-255962

Documentable

False

Rule Version

ARST-ND-000790

Severity Override Guidance

Verify the Arista network device is configured to audit all DOD auditable events.

Verify the logging settings in the configuration file with the following example:

switch#sh running-config | section logging

logging buffered informational
logging trap informational

NOTE: Acceptable settings include debugging, informational, and notifications to adjust syslog server traffic impact. Setting to higher severity levels can cause necessary lower-level events to be missed.

If the Arista network device is not configured to audit all DOD auditable events, this is a finding.

Check Content Reference

M

Target Key

5511