STIGQter: STIG Summary: Riverbed NetProfiler Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.

DISA Rule

SV-256072r1015798_rule

Vulnerability Number

V-256072

Group Title

SRG-APP-000026-NDM-000208

Rule Version

RINP-DM-000004

Severity

CAT I

CCI(s)

• CCI-000018 - Automatically audit account creation actions.
• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001403 - Automatically audit account modification actions.
• CCI-001404 - Automatically audit account disabling actions.
• CCI-001405 - Automatically audit account removal actions.
• CCI-001464 - Initiates session audits automatically at system start-up.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-003938 - Automatically generate audit records of the enforcement actions.
• CCI-002234 - Log the execution of privileged functions.
• CCI-002605 - Install security-relevant software updates within an organization-defined time period of the release of the updates.

Weight

10

Fix Recommendation

Go to Administration >> Audit Trail.

Click "Audit Settings".

Under "Logging Settings", select "Log all Audit Events".

Click "OK" to save the settings.

Check Contents

Enable all DOD-required audit requirements, including changes to user accounts and use of privileged functions.

Go to Administration >> Audit Trail.

Click "Audit Settings".

Check under "Logging Settings".

If "Log all Audit Events" is not selected, this is a finding.

Vulnerability Number

V-256072

Documentable

False

Rule Version

RINP-DM-000004

Severity Override Guidance

Enable all DOD-required audit requirements, including changes to user accounts and use of privileged functions.

Go to Administration >> Audit Trail.

Click "Audit Settings".

Check under "Logging Settings".

If "Log all Audit Events" is not selected, this is a finding.

Check Content Reference

M

Target Key

5514