STIGQter: STIG Summary: Cisco ACI NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026: STIGQter: STIG Summary: Cisco ACI NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:SV-271932r1114348_rule
V-271932
SRG-APP-000795-NDM-000130
CACI-ND-000017
CAT II
10
Configure event notifications based on audit log entries and associate those notifications with specific user roles or groups within the organization through the AAA configuration.
Preferred method (required):
1. Configure the APIC to forward audit log events to a centralized Syslog such as a SIEM platform. (SRG-APP-000515-NDM-000325)
2. Configure the SIEM's capabilities to aggregate, analyze, and correlate audit events with other system logs for advanced threat detection and incident response.
Note: Although the ACI can perform this function, it leverages the Call Home feature, which must be set to disabled by another STIG requirement.
Verify the remote syslog or SIEM is sending event notifications to personnel based on audit log entries and associating those notifications with specific user roles or groups within the organization through the Authentication, Authorization, and Accounting (AAA) configuration.
If the ACI is not configured to send audit records to the central audit server, this is a finding.
V-271932
False
CACI-ND-000017
Verify the remote syslog or SIEM is sending event notifications to personnel based on audit log entries and associating those notifications with specific user roles or groups within the organization through the Authentication, Authorization, and Accounting (AAA) configuration.
If the ACI is not configured to send audit records to the central audit server, this is a finding.
M
5682