V-55329

Discussion

It is critical that when the IDPS is at risk of failing to process audit logs as required, it takes action to mitigate the failure<br /><br />Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Since action must be taken immediately, these messages will be designated as a critical severity level and this level must be sent as part of the alert message.

Check Content

Verify the IDPS provides assign a critical severity level to all audit processing failures.<br /><br />If the IDPS does not assign a critical severity level to all audit processing failures, this is a finding.