Detections
Analytics
JUEX-NM-000670 - The Juniper EX switch must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Information
The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Solution
Add the following stanzas to the configuration.set system syslog host <external syslog host1 IPv4 or IPv6 address> any info
set system syslog host <external syslog host2 IPv4 or IPv6 address> any info
Note: The time-format command supports including the year and/or the time in milliseconds. The default format does not include the year and time is recorded in seconds.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M01_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY
References: 800-53|AU-4(1), 800-53|SI-2c., CAT|I, CCI|CCI-001851, CCI|CCI-002605, Rule-ID|SV-253944r1137890_rule, STIG-ID|JUEX-NM-000670, Vuln-ID|V-253944
Plugin: Juniper
Control ID: 1ccaa32ee522ec6c4b5321ec539102337a1e767723907391ee8fdb368f03e55d