The Cisco ASA must be configured to off-load log records to a centralized log server.

An XCCDF Rule

Description

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.

ID: SV-239879r856155_rule
Version: CASA-IP-000110
Severity: Medium
References: CCI-001851
Updated: 3 days ago

Remediation Templates

Configure Firepower to send log records to a syslog server as shown in the following steps:

Step 1: Navigate to Configuration >> ASA Firepower Configuration >> Policies >> Actions Alerts.

Step 2: Click the Create Alert drop-down menu and choose option Create Syslog Alert. 
Step 3: Enter the following values for the Syslog server:
   Host:  Specify the IP address/hostname of Syslog server.
   Port:  Specify the port number of Syslog server.

Step 4: Click Store ASA FirePOWER Changes.

The Cisco ASA must be configured to off-load log records to a centralized log server.

Description

Remediation Templates

A Manual Procedure