Rule ID
SV-284237r1223978_rule
Version
V1R1
Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FMT_SMF_EXT.4.1 Reference: PP-UEM-401005 Satisfies: SRG-APP-000089-UEM-100012, SRG-APP-000358-UEM-100013
Review the MDM Agent documentation and configuration settings to determine if the following function is enabled: Read audit logs of the MD. This validation procedure is performed on the MDM Administration Console. On the MDM console, do the following: 1. Authenticate to the Workspace ONE UEM console as the administrator. 2. Navigate to Groups & Settings >> All Settings >> Devices & Users >> General >> Privacy. Enable "Request Device Log" in the privacy settings. If "Request Device Log" is present, then no device log is being requested from the MD, and this is a finding.
Configure the MDM Agent to enable the following function: Read audit logs of the MD. On the MDM console, do the following: 1. Authenticate to the Workspace ONE UEM console as the administrator. 2. Navigate to Groups & Settings >> All Settings >> Devices & Users >> General >> Privacy. Enable "Request Device Log" in the privacy settings. 3. Select "Save".