STIGQter: STIG Summary: Axonius Federal Systems Ax-OS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Ax-OS must off-load audit records onto a different system or media than the system being audited.

DISA Rule

SV-276014r1122692_rule

Vulnerability Number

V-276014

Group Title

SRG-APP-000358

Rule Version

AXOS-00-000070

Severity

CAT I

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-000174 - Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.
• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
• CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
• CCI-000159 - Use internal system clocks to generate time stamps for audit records.
• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.
• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
• CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.
• CCI-001294 - Alert organization-defined personnel or roles of failed security verification tests.
• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).
• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.
• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
• CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
• CCI-001877 - Provide an audit reduction capability that supports after-the-fact investigations of incidents.
• CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.
• CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
• CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
• CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
• CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.
• CCI-001896 - Enforce dual authorization for movement and/or deletion of organization-defined audit information.
• CCI-003821 - Implement the capability to centrally review and analyze audit records from multiple components within the system.
• CCI-003822 - Implement an audit reduction capability that supports on-demand audit review and analysis.
• CCI-003823 - Implement an audit reduction capability that supports on-demand reporting requirements.
• CCI-003824 - Implement an audit reduction capability that supports after-the-fact investigations of incidents.
• CCI-003825 - Implement a report generation capability that supports on-demand audit review and analysis.
• CCI-003826 - Implement a report generation capability that supports on-demand reporting requirements.
• CCI-003827 - Implement a report generation capability that supports after-the-fact investigations of incidents.
• CCI-003828 - Implement an audit reduction capability that does not alter original content or time ordering of audit records.
• CCI-003829 - Implement a report generation capability that does not alter original content or time ordering of audit records.
• CCI-003830 - Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
• CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
• CCI-003834 - Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
• CCI-004992 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.
• CCI-004996 - Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.
• CCI-004997 - Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.

Weight

10

Fix Recommendation

Select the gear icon (System Settings) >> External Integrations >> Syslog.

Under the Syslog menu, enable "Use Syslog".

Under the Syslog menu, configure "Syslog instance" for an external log server.

Check Contents

Select the gear icon (System Settings) >> External Integrations >> Syslog.

Under the Syslog menu, if the "Use Syslog" slide bar is not selected, this is a finding.

Under the Syslog menu, if "Syslog instance" has not been configured for an external log server(or otherwise proven Syslog is being captured by an external log server), this is a finding.

Vulnerability Number

V-276014

Documentable

False

Rule Version

AXOS-00-000070

Severity Override Guidance

Select the gear icon (System Settings) >> External Integrations >> Syslog.

Under the Syslog menu, if the "Use Syslog" slide bar is not selected, this is a finding.

Under the Syslog menu, if "Syslog instance" has not been configured for an external log server(or otherwise proven Syslog is being captured by an external log server), this is a finding.

Check Content Reference

M

Target Key

5710