STIGQter: STIG Summary: Dragos Platform 2.x Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Apr 2026:

Dragos must configure idle timeouts at 10 minutes.

DISA Rule

SV-270904r1058027_rule

Vulnerability Number

V-270904

Group Title

SRG-APP-000002

Rule Version

DRAG-OT-000020

Severity

CAT II

CCI(s)

• CCI-000060 - Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.
• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

Weight

10

Fix Recommendation

Set session timeout configurations.

In the UI, navigate to Admin >> SiteStore Management >> Advanced Settings.

Click "Configurations".

Set Idle Auto-Logout Minutes to "10".

Set Re-Authenticate User Device (Inactive) to "1h".

Click "Save & Apply".

Check Contents

Verify session timeout is configured.

In the UI, navigate to Admin >> SiteStore Management >> Advanced Settings.

Click "Configurations".

If Idle Auto-Logout Minutes is not set to "10" minutes, this is a finding.

If Re-Authenticate User Device (Inactive) is not set to "1h", this is a finding.

Vulnerability Number

V-270904

Documentable

False

Rule Version

DRAG-OT-000020

Severity Override Guidance

Verify session timeout is configured.

In the UI, navigate to Admin >> SiteStore Management >> Advanced Settings.

Click "Configurations".

If Idle Auto-Logout Minutes is not set to "10" minutes, this is a finding.

If Re-Authenticate User Device (Inactive) is not set to "1h", this is a finding.

Check Content Reference

M

Target Key

5675