Skip to content
Catalogs
XCCDF
Central Log Server Security Requirements Guide
SRG-APP-000516
For devices and hosts within the scope of coverage, the Central Log Server must be configured to automatically aggregate events that indicate account actions.
For devices and hosts within the scope of coverage, the Central Log Server must be configured to automatically aggregate events that indicate account actions. An XCCDF Rule
For devices and hosts within the scope of coverage, the Central Log Server must be configured to automatically aggregate events that indicate account actions.
Medium Severity
<VulnDiscussion>If the Central Log Server is configured to filter or remove account log records transmitted by devices and hosts within its scope of coverage, forensic analysis tools will be less effective at detecting and reporting on important attack vectors. A comprehensive account management process must include capturing log records for the creation of user accounts and notification of administrators and/or application owners. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.
This requirement addresses the concern that the Central Log Server may be configured to filter out certain levels of information, which may result in the discarding of DoD-required accounting actions addressed in the AC-2 (4) controls such as creation, modification, deletion, and removal of privileged accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>