The network devices must be configured to alert the administrator of a potential attack or system failure.

From Firewall Security Technical Implementation Guide - Cisco

Part of The IDS or FW is not configured to alarm the admin

SV-3176r2_rule The network devices must be configured to alert the administrator of a potential attack or system failure.

Vulnerability discussion

The IDS or firewall is the first device that is under the sites control that has the possibility to alarm the local staff of an ongoing attack. An alert from either of these devices can be the first indication of an attack or system failure.

Check content

The SA shall define clipping levels / thresholds as a baseline to display alert messages on specific attacks identifying the potential security violation or attack. Review the IDS or firewall configuration to determine what alerts have been defined and how the notifications are performed. If the device is not configured to alert the administrator of potential failures, this is a finding.

Fix text

Configure the IDS or firewall to alarm the SA of potential attacks or system failure.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.