V-55325

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.<br /><br />This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

Check Content

Verify the IDPS off-loads log records to a centralized log server.<br /><br />If the IDPS does not off-load log records to a centralized log server, this is a finding.