STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

DISA Rule

SV-258923r1015933_rule

Vulnerability Number

V-258923

Group Title

SRG-APP-000291

Rule Version

VCSA-80-000123

Severity

CAT II

CCI(s)

• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Security >> Alarm Definitions.

Click "Add".

Provide the alarm name of "SSO account actions - com.vmware.sso.PrincipalManagement" and an optional description.

From the "Target type" dropdown menu, select "vCenter Server".

Click "Next".

Paste "com.vmware.sso.PrincipalManagement" (without quotes) in the line after "IF" and press "Enter".

Next to "Trigger the alarm and", select "Show as Warning".

Configure the desired notification actions that will inform the SA and ISSO of the event.

Click "Next". Click "Next" again. Click "Create".

Check Contents

From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Security >> Alarm Definitions.

Verify there is an alarm created to alert upon all SSO account actions.

The alarm name may vary, but it is suggested to name it "SSO account actions - com.vmware.sso.PrincipalManagement".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-AlarmDefinition | Where {$_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "com.vmware.sso.PrincipalManagement"} | Select Name,Enabled,@{N="EventTypeId";E={$_.ExtensionData.Info.Expression.Expression.EventTypeId}}

If an alarm is not created to alert on SSO account actions, this is a finding.

Vulnerability Number

V-258923

Documentable

False

Rule Version

VCSA-80-000123

Severity Override Guidance

From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Security >> Alarm Definitions.

Verify there is an alarm created to alert upon all SSO account actions.

The alarm name may vary, but it is suggested to name it "SSO account actions - com.vmware.sso.PrincipalManagement".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-AlarmDefinition | Where {$_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "com.vmware.sso.PrincipalManagement"} | Select Name,Enabled,@{N="EventTypeId";E={$_.ExtensionData.Info.Expression.Expression.EventTypeId}}

If an alarm is not created to alert on SSO account actions, this is a finding.

Check Content Reference

M

Target Key

5573