MobileIron Sentry must off-load audit records onto a different system or media than the system being audited.
An XCCDF Rule
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
- ID
- SV-251002r802228_rule
- Version
- MOIS-ND-000900
- Severity
- Low
- References
- Updated
Remediation Templates
A Manual Procedure
Configure MobileIron Sentry to forward/offload audit to a different system.
1. Log in to MobileIron Sentry.
2. Go to Settings >> Syslog.
3. Configure a new syslog server if not already added.
4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit".