Network device logs must be timestamped.

From Firewall Security Technical Implementation Guide

Part of Device logs are not timestamped.

Associated with IA controls: ECTB-1, ECSC-1

SV-32503r2_rule Network device logs must be timestamped.

Vulnerability discussion

Device logs can be used for forensic analysis in support of incident as well as to aid with normal traffic analysis. It can take numerous days to recover from a firewall outage when a proper backup scheme is not used.

Check content

Review the device configuration to validate timestamps are configured for logging. If timestamps are not configured for logging purposes, this is a finding.

Fix text

Configure the network device to include timestamps on all device logs.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.