The IDPS must off-load log records to a centralized log server.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-206902
SRG-NET-000334-IDPS-00191
SV-206902r856540_rule
Medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.
This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.