Detections
Analytics

CASA-FW-000300 - The Cisco ASA must be configured to generate an alert that can be forwarded to organization-defined personnel and/or the firewall administrator when denial-of-service (DoS) incidents are detected - Recipient-address

Information

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The firewall generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs), which require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.

Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

CJCSM 6510.01B, 'Cyber Incident Handling Program', lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The firewall must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel. The ISSM or ISSO may designate the firewall/system administrator or other authorized personnel to receive the alert within the specified time, validate the alert, and then forward only validated alerts to the ISSM and ISSO.

Solution

Step 1: Configure basic and scanning threat detection as shown below.

ASA(config)# threat-detection basic-threat
ASA(config)# threat-detection scanning-threat

Step 2: Configure the ASA to send an email alert to the organization-defined personnel and/or firewall administrator for syslog messages at severity level 4.

ASA(config)# logging mail 4
ASA(config)# logging recipient-address [email protected]
ASA(config)# logging recipient-address [email protected]
ASA(config)# logging from-address [email protected]
ASA(config)# smtp-server 10.1.12.33
ASA(config)# end

Note: As an alternative to sending email alerts, SNMP traps could be sent to an SIEM that is monitored.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_ASA_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4(5), CAT|II, CCI|CCI-002664, Rule-ID|SV-239872r971533_rule, STIG-ID|CASA-FW-000300, Vuln-ID|V-239872

Plugin: Cisco

Control ID: 6fccaac423cfd0a9995e5643b4e976249dcfea1c4772b2378e10a75ff7a27060