The HP FlexFabric Switch must generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

From HP FlexFabric Switch NDM Security Technical Implementation Guide

Part of SRG-APP-000359-NDM-000294

Associated with: CCI-001855

SV-80733r1_rule The HP FlexFabric Switch must generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

Vulnerability discussion

If security personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. This could lead to the loss of audit information. Note that while the HP FlexFabric Switch must generate the alert, notification may be done by a management server.

Check content

Determine if the HP FlexFabric Switch provides the capability for organization-identified individuals or roles to change the auditing to be performed based on all selectable event criteria within near-real-time. [HP] display info-center Information Center: Enabled Console: Enabled Monitor: Enabled Log host: Enabled 192.100.50.27, port number: 514, host facility: local7 Log buffer: Enabled Max buffer size 1024, current buffer size 512 Current messages 66, dropped messages 0, overwritten messages 0 Log file: Enabled Security log file: Enabled Information timestamp format: Log host: Date Other output destination: Date If the HP FlexFabric Switch does not provide the capability for organization-identified individuals or roles to change the auditing to be performed based on all selectable event criteria within near-real-time, this is a finding.

Fix text

Configure the HP FlexFabric Switch to generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity. [HP] info-center security-logfile alarm-threshold 75

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer