JUEX-NM-000420 - The Juniper EX switch must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts.

Information

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.

Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).

Solution

Configure the network device to generate an immediate real-time alert of all audit failure events requiring real-time alerts.

set chassis disk-partition /var level full free-space <0..100>
set chassis disk-partition /var level full free-space percent
set chassis disk-partition /var level high free-space <0..100>
set chassis disk-partition /var level high free-space percent
Note: 'High' disk free-space value must be equal to or greater than 'full' free-space value.

set snmp health-monitor interval <1..2147483647 seconds>
set snmp health-monitor rising-threshold <1..100 percent>
set snmp health-monitor falling-threshold <0..100 percent>
Note: Falling threshold value must be less than the rising-threshold value or commit fails.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5(2), CAT|II, CCI|CCI-001858, Rule-ID|SV-253919r961401_rule, STIG-ID|JUEX-NM-000420, Vuln-ID|V-253919

Plugin: Juniper

Control ID: 19e8ac63266e8161e0c61f1ddbf6e3d743b9289ee0826c5ed16c82eed8024380