STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must generate an immediate real-time alert of all audit failure events requiring real-time alerts.

DISA Rule

SV-269791r1051758_rule

Vulnerability Number

V-269791

Group Title

SRG-APP-000360-NDM-000295

Rule Version

OS10-NDM-000670

Severity

CAT II

CCI(s)

CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Weight

Fix Recommendation

Configure the OS10 Switch to use either TCP or TLS for connection to the remote syslog servers:

OS10(config)# logging server 100.94.75.111 tcp

Check Contents

Determine if the OS10 Switch generates an immediate alert of all audit failure events requiring real-time alerts.

Verify that syslog is configured to use a connection-based protocol, either TCP or TLS, when connecting to a remote syslog server:

OS10# show running-configuration logging
!
...
logging server 100.94.75.111 tcp 514

If the OS10 Switch is not configured to use either TCP or TLS for connection to the remote syslog servers, this is a finding.

The Dell OS10 Switch must generate an immediate real-time alert of all audit failure events requiring real-time alerts.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key