Information
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack; to recognize resource utilization or capacity thresholds; or to identify an improperly configured network device. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis.
Satisfies: SRG-APP-000095-NDM-000225, SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230, SRG-APP-000516-NDM-000334, SRG-APP-000357-NDM-000293, SRG-APP-000360-NDM-000295, SRG-APP-000505-NDM-000322
Solution
Configure a logging level sufficient to capture all DOD auditable events.
switch(config)#logging buffered informational
switch(config)#logging trap informational
NOTE: Acceptable settings include debugging, informational, and notifications to adjust syslog server traffic impact. Setting to higher severity levels can cause necessary lower-level events to be missed.
Item Details
References: CAT|II, CCI|CCI-000130, CCI|CCI-000131, CCI|CCI-000132, CCI|CCI-000133, CCI|CCI-000134, CCI|CCI-000169, CCI|CCI-000172, CCI|CCI-001487, CCI|CCI-001849, CCI|CCI-001858, Rule-ID|SV-255962r882228_rule, STIG-ID|ARST-ND-000790, Vuln-ID|V-255962
Control ID: 8246536dcd1d5bc1addad2450b0c3986df18e63f2dda09db4d34a2d88fb439f0