Details

Syslog messages sent to a remote host should include message levels of ‘notice’ and above. Higher levels such as ‘crit’ and ‘err’ do not include warnings of impending problems or notices of administrative actions.

Solution

Check organizational standards to determine the appropriate level for this appliance. Edit the configuration and add or modify this line:n

logging trap n

Omit the trap parameter to use the default level, ‘notice’.

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system FireEye.

References

• 800-53|AU-9(2)

Source

• Tenable.com/audits