← Back to Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide

V-286592

CAT II (Medium)

The UAG must off-load all audit records to a centralized log server.

Rule ID

SV-286592r1291673_rule

STIG

Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001851

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-NET-000334-ALG-000050, SRG-NET-000511-ALG-000051

Check Content

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to Advanced Settings >> Syslog Server Settings.

Click the gear icon to edit.

If no valid syslog servers are configured, this is a finding.

For each syslog server present, click the associated gear icon and verify the following: 

1. Verify the "Syslog Include System Messages" toggle is enabled.

If the "Syslog Include System Messages" toggle is not enabled on each configured syslog server, this is a finding.

2. Verify the "Category" drop-down menu is equal to "All Events".

If the "Category" is not set to "All Events" on each configured syslog server, this is a finding.

Fix Text

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to Advanced Settings >> Syslog Server Settings. 

Click the gear icon to edit.

Add a new syslog server:

- Click "Add Syslog Entry", select the desired protocol and fill in all required fields. Ensure that the "Syslog Include System Messages" toggle is enabled.

- Set "Category" drop-down menu to "All Events".

- Click "Add", then click "Save".

Edit an existing syslog server:

- For each syslog server present, click the associated gear icon and enable the "Syslog Include System Messages" toggle.

- Set "Category" drop-down to "All Events".

- Click "OK".