STIGQter: STIG Summary: Central Log Server Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 24 Jul 2020:

The Central Log Server must be configured for centralized management of the events repository for the purposes of configuration, analysis, and reporting.

DISA Rule

SV-95857r1_rule

Vulnerability Number

V-81143

Group Title

SRG-APP-000356-AU-000090

Rule Version

SRG-APP-000356-AU-000090

Severity

CAT III

CCI(s)

• CCI-001844 - The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.

Weight

10

Fix Recommendation

Configure access for management tools used by administrators at management workstations, particularly those used for remote access. This often uses user access profiles or remote access configuration to enable secure and authorized access to the Central Log Server.

Enable management from one or more management workstations or a secure browser.

Verify remote communications from the management station using a secure, approved version of the protocol (e.g., TLS). Limit access based on user role, location, or remote device wherever possible.

Check Contents

Examine the configuration.

Verify that centralized management of the events repository is enabled and configured for all hosts and devices within the scope of coverage.

If the Central Log Server is not enabled to allow centralized management of the events repository for the purposes of configuration, analysis, and reporting, this is a finding.

Vulnerability Number

V-81143

Documentable

False

Rule Version

SRG-APP-000356-AU-000090

Severity Override Guidance

Examine the configuration.

Verify that centralized management of the events repository is enabled and configured for all hosts and devices within the scope of coverage.

If the Central Log Server is not enabled to allow centralized management of the events repository for the purposes of configuration, analysis, and reporting, this is a finding.

Check Content Reference

M

Target Key

3395

Comments