Detections
Analytics

1.7 Host integrated hardware management controller must enable remote logging of events

Information

The host's integrated hardware management controller provides critical out-of-band server oversight. For enhanced security, it is essential to configure this controller to log events remotely. This practice ensures that hardware-related logs are sent to an off-site location, protecting them from potential tampering and offering a centralized record of server health and activities.

Enabling remote logging of events on the integrated hardware management controller ensures that all hardware-level activities are securely recorded off-site, providing traceability, mitigating data tampering risks, and facilitating incident response.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Locate the controller's Syslog, Remote Logging, Event Forwarding, or equivalent configuration and:

 - Enable remote event logging.
 - Configure the hostname or IP address of the approved centralized log collector.
 - Configure the appropriate port and protocol.
 - Use TLS or another protected transport where supported.
 - Select the required event categories, including hardware, security, authentication, firmware, and administrative events.
 - Save the configuration.

Impact:

No impact noted.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: VMware

Control ID: 92100f8654bc90ad05314aafba9990afe8d4b4e73aa92d8cb0cf97f9d15b865c