Skip to content
Log In

The TPS must generate a log record so an alert can be configured to, at a minimum, the system administrator when malicious code is detected.

An XCCDF Rule

Description

Without an alert, security personnel may be unaware of an impending failure of the audit capability, and the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The TPS generates an immediate (within seconds) alert which notifies designated personnel of the incident. Sending a message to an unattended log or console does not meet this requirement since that will not be seen immediately. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. Satisfies: SRG-NET-000248-IDPS-00206, SRG-NET-000249-IDPS-00222, SRG-NET-000385-IDPS-00210

ID
SV-242199r1018785_rule
Version
TIPP-IP-000360
Severity
High
References
Updated

Remediation Templates

A Manual Procedure

1. In the Trend Micro SMS, navigate to "Profiles" and "Shared Settings". 
2. Under "Action Sets: 
   a. Select "Block+Notify" and edit. 
   b. Select Notifications, and check "Remote Syslog". 
   c. Select "Finish".