← Back to Ivanti Policy Secure NDM Security Technical Implementation Guide

V-284520

CAT II (Medium)

The Ivanti Policy Secure must be configured to enable "Detailed Log Note".

Rule ID

SV-284520r1244926_rule

STIG

Ivanti Policy Secure NDM Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000130 CCI-000131 CCI-000132 CCI-000133 CCI-000134 CCI-000135

Discussion

It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured network device. Without this capability, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Satisfies: SRG-APP-000095-NDM-000225, SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000101-NDM-000231

Check Content

In the Web UI, navigate to System >> Log/Monitoring >> User Access >> Settings.

Under the "Select Events to Log" section, if "Detailed Log Note" is not checked, this is a finding.

Fix Text

1. In the Web UI, navigate to System >> Log/Monitoring >> User Access >> Settings.
2. Under the "Select Events to Log" section, check the box for "Detailed Log Note".
3. Click "Save Changes".