VCWN-65-000050 - The vCenter Server for Windows must alert administrators on permission update operations.

Information

If personnel are not notified of permission events, they will not be aware of possible unsecure situations.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Web Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions. Right-click in the empty space and select 'New Alarm'. On the 'General' tab provide an alarm name and description, Select 'vCenter Server' for alarm type and 'Monitor for specific events occurring on this object', check 'Enable this alarm'. On the 'Triggers' tab, click 'Add' for a trigger and in the event column enter 'vim.event.PermissionUpdatedEvent' and click 'OK'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y23M07_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-6c., CAT|II, CCI|CCI-001294, Rule-ID|SV-216869r879661_rule, STIG-ID|VCWN-65-000050, STIG-Legacy|SV-104633, STIG-Legacy|V-94803, Vuln-ID|V-216869

Plugin: VMware

Control ID: b3e1eb5feae91a4014a43a4ba230f4fb63cd5158430a77aa82dcc8f9795d65cf