STIGQter: STIG Summary: Xylok Security Suite 20.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Xylok Security Suite must use a central log server for auditing records.

DISA Rule

SV-269586r1155158_rule

Vulnerability Number

V-269586

Group Title

SRG-APP-000745

Rule Version

XYLK-20-000291

Severity

CAT I

CCI(s)

CCI-003821 - Implement the capability to centrally review and analyze audit records from multiple components within the system.
CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
CCI-001877 - Provide an audit reduction capability that supports after-the-fact investigations of incidents.
CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.
CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.
CCI-001896 - Enforce dual authorization for movement and/or deletion of organization-defined audit information.
CCI-003822 - Implement an audit reduction capability that supports on-demand audit review and analysis.
CCI-003823 - Implement an audit reduction capability that supports on-demand reporting requirements.
CCI-003824 - Implement an audit reduction capability that supports after-the-fact investigations of incidents.
CCI-003825 - Implement a report generation capability that supports on-demand audit review and analysis.
CCI-003826 - Implement a report generation capability that supports on-demand reporting requirements.
CCI-003827 - Implement a report generation capability that supports after-the-fact investigations of incidents.
CCI-003828 - Implement an audit reduction capability that does not alter original content or time ordering of audit records.
CCI-003829 - Implement a report generation capability that does not alter original content or time ordering of audit records.
CCI-003830 - Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
CCI-003834 - Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
CCI-003938 - Automatically generate audit records of the enforcement actions.

Weight

Fix Recommendation

Edit /etc/systemd/journald.conf to include at least these lines:

[Journal]
ForwardToSyslog=yes

Edit /etc/rsyslog.conf to include these lines:

module(load="imuxsock") # provides support for local system logging
module(load="imjournal") # provides access to the systemd journal
*.* @@yoursiem:1234

Ensure yoursiem:1234 points to the correct host and port for your network.

Restart journald and rsyslogd:

# systemctl restar rsyslog systemd-journald

Check Contents

Verify that journald sends logs to rsyslog:

# grep ForwardToSyslog /etc/systemd/journald.conf
ForwardToSyslog=yes

If ForwardToSyslog is commented out or not set to "yes," this is a finding.

Verify that rsyslog is set to receive journald logs:

# grep '\(imuxsock\|imjournal\)' /etc/rsyslog.conf /etc/rsyslog.d/*
module(load="imuxsock") # provides support for local system logging
module(load="imjournal") # provides access to the systemd journal

If either module is not present or disabled, this is a finding.

# grep '[[:space:]]@.*' /etc/rsyslog.conf /etc/rsyslog.d/*
*.* @@yoursiem:1234

If rsyslog is not configured to forward logs to a central SIEM server, this is a finding.

Vulnerability Number

V-269586

Documentable

False

Rule Version

XYLK-20-000291

Severity Override Guidance

Check Content Reference

Target Key

5665