The IDPS must off-load log records to a centralized log server.

From Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide

Associated with: CCI-001851

SV-69571r1_rule The IDPS must off-load log records to a centralized log server.

Vulnerability discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

Check content

Verify the IDPS off-loads log records to a centralized log server. If the IDPS does not off-load log records to a centralized log server, this is a finding.

Fix text

Configure the IDPS to off-load log records to a centralized log server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.