Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Central Log Server must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.
Description
Discussion Text
In this case the information producer is the device based on IP address or some other identifier of the device producing the information. The source of the record must be bound to the record using cryptographic means.
Some events servers allow the administrator to retain only portions of the record sent by devices and hosts.
This requirement applies to log aggregation servers with the role of fulfilling the DoW requirement for a central log repository. The syslog, SIEM, or other event servers must retain this information with each log record to support incident investigations.
Some events servers allow the administrator to retain only portions of the record sent by devices and hosts.
This requirement applies to log aggregation servers with the role of fulfilling the DoW requirement for a central log repository. The syslog, SIEM, or other event servers must retain this information with each log record to support incident investigations.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.