← Back to Cisco Secure Network Analytics (SNA) Security Technical Implementation Guide

V-284935

CAT I (High)

The Cisco SNA appliance must be configured to send log data to at least one central log server for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO). For boundary devices, two log servers are required.

Rule ID

SV-284935r1212214_rule

STIG

Cisco Secure Network Analytics (SNA) Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001851

Discussion

The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can be used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, is important for showing whether someone is an internal employee or an outside threat. Satisfies: SRG-APP-000516-NDM-000350, SRG-APP-000515-NDM-000325

Check Content

Verify the Cisco SNA appliance is configured to send log data to at least one central log server.

Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> Network Services tab >> Audit Log Destination (Syslog over TLS). Verify one syslog server is configured.

If the Cisco SNA appliance is not configured to send log data to at least one central log server, this is a finding.

Fix Text

Configure the Cisco SNA appliance to send log data to at least one central log server. Repeat these steps for each Syslog Server needed.

Navigate to SNA Dashboard >> Configure >> Central Management >> Actions... >> Edit Appliance Configuration >> Network Services tab >> Audit Log Destination (Syslog over TLS) >> Add New. 

Input a Server Name or IP Address, Destination Port, and Certificate Revocation Mode. 

Apply Settings.