← Back to ForeScout CounterACT NDM Security Technical Implementation Guide

V-255629

CAT II (Medium)

CounterACT must enable Threat Protection notifications to alert security personnel to Cyber events detected by a CounterACT IAW CJCSM 6510.01B.

Rule ID

SV-255629r961863_rule

STIG

ForeScout CounterACT NDM Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000366 CCI-001274

Discussion

CJCSM 6510.01B, "Cyber Incident Handling Program", in subsection e.(6)(c) sets forth requirements for Cyber events detected by an automated system. By immediately displaying an alarm message, potential security violations can be identified more quickly even when administrators are not logged into the network device.

Check Content

Verify Threat Protection notifications are enabled and configured.

1. Select Tools >> Options >> Threat Protection.
2. At the bottom of the Threat Protection pane, select "Customer" and then select the "Notify" tab.
3. Verify the Maximum emails per day is set to "15" and infected host notification is set to 1 hour.

If CounterACT does not enable Threat Protection notifications to alert security personnel to Cyber events detected by a CounterACT IAW CJCSM 6510.01B, this is a finding.

Fix Text

Enable and configure Threat Protection notifications.

1. Select Tools >> Options >> Threat Protection.
2. At the bottom of the Threat Protection pane, select "Customer" and then select the "Notify" tab.
3. Modify the Maximum emails per day to "15" and infected host notification to 1 hour.