Details
The ISSO must ensure an acknowledgement message identifying a reference to the potential security violation is logged and it contains a notice that it has been acknowledged, the time of the acknowledgement and the user identifier that acknowledged the alarm, at the remote administrator session that received the alarm.
Acknowledging the alert could be a single event, or different events. In addition, assurance is required that each administrator that received the alarm message also receives the acknowledgement message, which includes some form of reference to the alarm message, who acknowledged the message and when.
NOTE: The Cisco ASA does not support all of the required features on the device itself. Utilizing a syslog server or SIEM product with advanced searching and alerting capabilities will greatly assist with this requirement.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Configure the firewall to send acknowledge messages to administrators, referencing the alarm, who acknowledged the alarm, and timestamps.
Supportive Information
The following resource is also helpful.
This control applies to the following type of system Cisco.
References
- CAT|III
- Rule-ID|SV-15282r2_rule
- STIG-ID|NET0398
- Vuln-ID|V-14656