STIGQter: STIG Summary: Palo Alto Networks NDM Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020:

The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur.

DISA Rule

SV-77201r1_rule

Vulnerability Number

V-62711

Group Title

SRG-APP-000091-NDM-000223

Rule Version

PANW-NM-000024

Severity

CAT II

CCI(s)

• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Weight

10

Fix Recommendation

Create a syslog server profile.
Go to Device >> Server Profiles >> Syslog
Select "Add"
In the "Syslog Server Profile", enter the name of the profile; select "Add".
In the "Servers" tab, enter the required information.
Name: Name of the syslog server
Server: Server IP address where the logs will be forwarded to
Port: Default port 514
Facility: Select from the drop down list
Select "OK".

Go to Device >> Log Settings >> System
For each severity level, select which destinations should receive the log messages.
Note: The "Syslog Profile" field must be completed.

Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Check Contents

Go to Device >> Log Settings >> System
If any severity level does not have a Syslog Profile, this is a finding.

Vulnerability Number

V-62711

Documentable

False

Rule Version

PANW-NM-000024

Severity Override Guidance

Go to Device >> Log Settings >> System
If any severity level does not have a Syslog Profile, this is a finding.

Check Content Reference

M

Target Key

2811

Comments