The Central Log Server must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

From Central Log Server Security Requirements Guide

Associated with: CCI-000366

SV-95893r1_rule The Central Log Server must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

Vulnerability discussion

In this case the information producer is the device based on IP address or some other identifier of the device producing the information. The source of the record must be bound to the record using cryptographic means.Some events servers allow the administrator to retain only portions of the record sent by devices and hosts.This requirement applies to log aggregation servers with the role of fulfilling the DoD requirement for a central log repository. The syslog, SIEM, or other event servers must retain this information with each log record to support incident investigations.

Check content

Examine the configuration. Verify the Central Log Server is configured to include the identity of the original source host or device where the event occurred as part of each aggregated log record. If the Central Log Server is not configured to include the identity of the original source host or device where the event occurred as part of the aggregated log record, this is a finding.

Fix text

Configure the Central Log Server to include the identity of the original source host or device as part of each aggregated log record.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.