STIGQter: STIG Summary: Riverbed NetIM NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The Riverbed NetIM must off-load audit records onto a different system or media than the system being audited.

DISA Rule

SV-275482r1147496_rule

Vulnerability Number

V-275482

Group Title

SRG-APP-000515-NDM-000325

Rule Version

RIIM-DM-000043

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Configure "rsyslog.d" service to send NetIM audit logs to central syslog.

1. Add or modify the following line in the "/etc/rsyslog.d" file:

$ sudo nano /etc/rsyslog.d/60-netim.conf

2. Add the following text:

*.* action(type="omfwd" target="<Syslog Server IP > " port="3514" protocol="tcp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")

3. Restart rsyslog service.

$ sudo service rsyslog restart

Check Contents

Verify auditing is configured to send events to a central log server by using the following command:

$ sudo grep -i action(type="omfwd" target="<Syslog Server IP > " port="3514" protocol="tcp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")

If auditing is configured to send events to a central log server, this is a finding.

Vulnerability Number

V-275482

Documentable

False

Rule Version

RIIM-DM-000043

Severity Override Guidance

Verify auditing is configured to send events to a central log server by using the following command:

$ sudo grep -i action(type="omfwd" target="<Syslog Server IP > " port="3514" protocol="tcp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")

If auditing is configured to send events to a central log server, this is a finding.

Check Content Reference

M

Target Key

5704