STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

DISA Rule

SV-258926r961401_rule

Vulnerability Number

V-258926

Group Title

SRG-APP-000360

Rule Version

VCSA-80-000150

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Configure the Central Logging Server being used to alert the SA and ISSO, at a minimum, on any AO-defined events.

Check Contents

Review the Central Logging Server being used to verify it is configured to alert the SA and ISSO, at a minimum, on any AO-defined events. Otherwise, this is a finding.

If there are no AO-defined events, this is not a finding.

Vulnerability Number

V-258926

Documentable

False

Rule Version

VCSA-80-000150

Severity Override Guidance

Review the Central Logging Server being used to verify it is configured to alert the SA and ISSO, at a minimum, on any AO-defined events. Otherwise, this is a finding.

If there are no AO-defined events, this is not a finding.

Check Content Reference

M

Target Key

5573