← Back to Ivanti Sentry 9.x NDM Security Technical Implementation Guide

V-251002

CAT III (Low)

Sentry must offload audit records onto a different system or media than the system being audited.

Rule ID

SV-251002r1028240_rule

STIG

Ivanti Sentry 9.x NDM Security Technical Implementation Guide

Version

V3R1

CCIs

CCI-001851

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity.

Check Content

Verify Sentry is configured to offload audit records to a different system. 

1. Log in to Sentry.
2. Go to Settings >> Syslog.
3. Verify that a syslog server is configured.
 
If the syslog server is not configured, this is a finding.

Fix Text

Configure Sentry to forward/offload audit to a different system.

1. Log in to Sentry.
2. Go to Settings >> Syslog.
3. Configure a new syslog server if not already added.
4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 
5. Set the Admin State to "Enable".
6. Click "Apply".