STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must be configured to send logs to a central log server.

DISA Rule

SV-258925r961395_rule

Vulnerability Number

V-258925

Group Title

SRG-APP-000358

Rule Version

VCSA-80-000148

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Open the VAMI by navigating to https://<vCenter server>:5480.

Log in with local operating system administrative credentials or with an SSO account that is a member of the "SystemConfiguration.BashShellAdministrator" group.

Select "Syslog" on the left navigation pane.

On the resulting pane on the right, click "Edit" or "Configure".

Edit or add the address and port of a site-specific syslog aggregator or Security Information Event Management (SIEM) system with the appropriate protocol.

User Datagram Protocol (UDP) is discouraged due to its stateless and unencrypted nature. Transport Layer Security (TLS) is preferred.

Click "Save".

Check Contents

Open the Virtual Appliance Management Interface (VAMI) by navigating to https://<vCenter server>:5480.

Log in with local operating system administrative credentials or with a Single Sign-On (SSO) account that is a member of the "SystemConfiguration.BashShellAdministrator" group.

Select "Syslog" on the left navigation pane.

On the resulting pane on the right, verify at least one site-specific syslog receiver is configured and is listed as "Reachable".

If no valid syslog collector is configured or if the collector is not listed as "Reachable", this is a finding.

Vulnerability Number

V-258925

Documentable

False

Rule Version

VCSA-80-000148

Severity Override Guidance

Check Content Reference

Target Key

5573