STIGQter: STIG Summary: HPE Alletra Storage ArcusOS Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Feb 2026:

The HPE Alletra Storage ArcusOS device must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required.

DISA Rule

SV-283429r1194981_rule

Vulnerability Number

V-283429

Group Title

SRG-APP-000516-NDM-000350

Rule Version

ASMP-ND-001100

Severity

CAT I

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Weight

10

Fix Recommendation

Configure the remote syslog host:

cli% setsys RemoteSyslogSecurityHost <hostname> <address-spec> [:port]

Note: The hostname and address are both required. If both IPv4 and IPv6 addresses are supplied, the IPv6 address must be enclosed in []. The default port is 6514 using TLS.

Configure the system to use remote syslog:

cli% setsys RemoteSyslog 1

Check Contents

Verify the system is configured to off-load security syslog events with the following command:

cli% showsys -d

--------------------Remote_Syslog_Status--------------------
Active : 1
General Server : es1-vlan3489-rsyslog.es1-storage.net
General Connection : TLS
RemoteSyslogProfile : None
Security Server : es1-vlan3489-rsyslog.es1-storage.net
Security Connection : TLS

For the options in the "Remote Syslog Status" section:

If "Active" is not "1", this is a finding.

If "Security Server" is not defined, this is a finding.

If "Security Connection" is not "TLS", this is a finding.

Vulnerability Number

V-283429

Documentable

False

Rule Version

ASMP-ND-001100

Severity Override Guidance

Verify the system is configured to off-load security syslog events with the following command:

cli% showsys -d

--------------------Remote_Syslog_Status--------------------
Active : 1
General Server : es1-vlan3489-rsyslog.es1-storage.net
General Connection : TLS
RemoteSyslogProfile : None
Security Server : es1-vlan3489-rsyslog.es1-storage.net
Security Connection : TLS

For the options in the "Remote Syslog Status" section:

If "Active" is not "1", this is a finding.

If "Security Server" is not defined, this is a finding.

If "Security Connection" is not "TLS", this is a finding.

Check Content Reference

M

Target Key

5742