Rule ID
SV-279255r1170692_rule
Version
V1R2
It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Logging the date and time of each detected event provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured network device. To establish and correlate the series of events leading up to an outage or attack, it is imperative that the date and time are recorded in all log records. Satisfies: SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230, SRG-APP-000101-NDM-000231, SRG-APP-000343-NDM-000289, SRG-APP-000505-NDM-000322, SRG-APP-000506-NDM-000323, SRG-APP-000516-NDM-000334, SRG-APP-000319-NDM-000283, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321
1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. 3. Scroll down to the "Syslog Loghosts". If a syslog server hostname/IP address is not configured, this is a finding. If the syslog loghost is configured but is not using the TLS protocol, this is a finding. 4. Scroll down to the "Default Notification" section. If "Syslog" is not "Enabled" and set to "all messages", this is a finding.
1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. Note: This section sets the "SSL Keyring", which is needed for the "SSL Device Profile". 3. Once the SSL Device Profile has been created properly, scroll down to the "Syslog Loghosts". 4. Click "Add loghost". 5. Click "TLS". 6. Enter the fully qualified domain name of the log server. 7. Enter the port, by default TLS syslog is 6514. 8. Under "SSL Device Profile", select the profile associated with the DOD PKI certificate and key created previously. 9. Click "Add". 10. Scroll down to "Default Notifications". Ensure that "Syslog" is set to "Enabled" and the "Level" is "All Messages". 11. On the syslog server, ensure the server is receiving the messages and troubleshoot any TLS-related communications issues.