The Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-279255	SRG-APP-000096-NDM-000226	SYME-ND-000530	SV-279255r1170692_rule	2025-12-18	1

Description
It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Logging the date and time of each detected event provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured network device. To establish and correlate the series of events leading up to an outage or attack, it is imperative that the date and time are recorded in all log records. Satisfies: SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230, SRG-APP-000101-NDM-000231, SRG-APP-000343-NDM-000289, SRG-APP-000505-NDM-000322, SRG-APP-000506-NDM-000323, SRG-APP-000516-NDM-000334, SRG-APP-000319-NDM-000283, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321

Description

It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Logging the date and time of each detected event provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured network device. To establish and correlate the series of events leading up to an outage or attack, it is imperative that the date and time are recorded in all log records. Satisfies: SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230, SRG-APP-000101-NDM-000231, SRG-APP-000343-NDM-000289, SRG-APP-000505-NDM-000322, SRG-APP-000506-NDM-000323, SRG-APP-000516-NDM-000334, SRG-APP-000319-NDM-000283, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321

ℹ️ Check
1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. 3. Scroll down to the "Syslog Loghosts". If a syslog server hostname/IP address is not configured, this is a finding. If the syslog loghost is configured but is not using the TLS protocol, this is a finding. 4. Scroll down to the "Default Notification" section. If "Syslog" is not "Enabled" and set to "all messages", this is a finding.

ℹ️ Check

1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. 3. Scroll down to the "Syslog Loghosts". If a syslog server hostname/IP address is not configured, this is a finding. If the syslog loghost is configured but is not using the TLS protocol, this is a finding. 4. Scroll down to the "Default Notification" section. If "Syslog" is not "Enabled" and set to "all messages", this is a finding.

✔️ Fix
1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. Note: This section sets the "SSL Keyring", which is needed for the "SSL Device Profile". 3. Once the SSL Device Profile has been created properly, scroll down to the "Syslog Loghosts". 4. Click "Add loghost". 5. Click "TLS". 6. Enter the fully qualified domain name of the log server. 7. Enter the port, by default TLS syslog is 6514. 8. Under "SSL Device Profile", select the profile associated with the DOD PKI certificate and key created previously. 9. Click "Add". 10. Scroll down to "Default Notifications". Ensure that "Syslog" is set to "Enabled" and the "Level" is "All Messages". 11. On the syslog server, ensure the server is receiving the messages and troubleshoot any TLS-related communications issues.

✔️ Fix

1. In the Edge SWG Web UI, navigate to the Administration tab. 2. Select the "Logging" and "Event Logging" areas. Note: This section sets the "SSL Keyring", which is needed for the "SSL Device Profile". 3. Once the SSL Device Profile has been created properly, scroll down to the "Syslog Loghosts". 4. Click "Add loghost". 5. Click "TLS". 6. Enter the fully qualified domain name of the log server. 7. Enter the port, by default TLS syslog is 6514. 8. Under "SSL Device Profile", select the profile associated with the DOD PKI certificate and key created previously. 9. Click "Add". 10. Scroll down to "Default Notifications". Ensure that "Syslog" is set to "Enabled" and the "Level" is "All Messages". 11. On the syslog server, ensure the server is receiving the messages and troubleshoot any TLS-related communications issues.