← Back to Trend Micro TippingPoint IDPS Security Technical Implementation Guide

V-242199

CAT I (High)

The TPS must generate a log record so an alert can be configured to, at a minimum, the system administrator when malicious code is detected.

Rule ID

SV-242199r1018785_rule

STIG

Trend Micro TippingPoint IDPS Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-002624 CCI-001243 CCI-002684 CCI-001242

Discussion

Without an alert, security personnel may be unaware of an impending failure of the audit capability, and the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The TPS generates an immediate (within seconds) alert which notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. Satisfies: SRG-NET-000248-IDPS-00206, SRG-NET-000249-IDPS-00222, SRG-NET-000385-IDPS-00210

Check Content

1. In the Trend Micro SMS, navigate to "Profiles" and "Shared Settings". 
2. Under "Action Sets, if "Remote Syslog", are not enabled for both the "Block+Notify" and "Block+Notify+Trace", this is a finding.

Fix Text

1. In the Trend Micro SMS, navigate to "Profiles" and "Shared Settings". 
2. Under "Action Sets: 
   a. Select "Block+Notify" and edit. 
   b. Select Notifications, and check "Remote Syslog". 
   c. Select "Finish".