STIGQter: STIG Summary: Arctic Wolf CylanceON-PREM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

CylanceON-PREM must be configured to use an external database if users exceed 30,000.

DISA Rule

SV-272637r1113525_rule

Vulnerability Number

V-272637

Group Title

SRG-APP-000357

Rule Version

CYLN-OP-000705

Severity

CAT II

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.
• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.

Weight

10

Fix Recommendation

If there are less than 30,000 users, this requirement is Not Applicable.

To install CylanceON-PREM with an external database, configure the virtual appliance during setup to use the chosen external database, specifying details such as the database server address, credentials, and database name, instead of relying on the default internal database included with the appliance. After reinstalling, verify with the database administrator (DBA) that the requirement is met.

Refer to https://docs.blackberry.com/en/unified-endpoint-security/cylanceonprem/cylance-on-prem-administration-guide/Configure_CylanceON-PREM_Virtual_Appliance/External_Database_Overview.

Check Contents

If there are less than 30,000 users, this requirement is Not Applicable.

Verify external database. Administrator privileges are required.

1. Log in to the admin console.
2. Navigate to CONFIGURATION >> Settings.
3. View Database Connection Settings.

If no database settings are found, the system was installed with the local database, and default size settings are used, this is a finding.

Vulnerability Number

V-272637

Documentable

False

Rule Version

CYLN-OP-000705

Severity Override Guidance

If there are less than 30,000 users, this requirement is Not Applicable.

Verify external database. Administrator privileges are required.

1. Log in to the admin console.
2. Navigate to CONFIGURATION >> Settings.
3. View Database Connection Settings.

If no database settings are found, the system was installed with the local database, and default size settings are used, this is a finding.

Check Content Reference

M

Target Key

5692