SEM STIG Full Text Privileged Commands?

joseph.ezell.1.ctr

This is the last requirement needed from Solarwinds for our systems. I need to be able to provide reports of Full Text Privileged Commands. I have searched everywhere and have found nothing. Has anyone had to do this before? If so how did you go about accomplishing this?

Thanks in Advance!!

Find more posts tagged with

Reports

solarwinds sem

nist

solarwinds lem

Accepted answers

All comments

joseph.ezell.1.ctr

Bump. [mention:64c4158e6d30499c9e4093df27d16241:23b05a61c3e5445190d9bfa00453bce4] Anyone available to help? Do I need to open a ticket to get help?

ecklerwr1

I understand what you're getting at for the STIGs. What you need to do is identify the windows events you want to filter on and come up with a filter for it which you can create a rule for. Here is some info about priv usage on windows: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-privilege-use

You have to be careful though because turning on some auditing can really put a demand on the system. One example we have a rule for is DTA: Data Transfer Tool Events. We created a tool inhouse that logs an event to the security event log for when our tool is ran and puts the info from the tool in the event log. We have a rule in SEM that records whenever it sees these events from one of our DTA workstations.

Bill

joseph.ezell.1.ctr

Sir, I feel I need to clarify what I am looking for. As an ISSO, I utilize NIST SP 800-53 & 53a Rev4 for RMF. I'm assessing a system and one of the control families, Auditing, Control AU-3(1) states, "The information system generates audit records containing the following additional information: [At a minimum, full-text recording of privileged commands or the individual identities of group account users]." (note: I do not have group accounts on my system)

If I understand what you're suggesting, you suggest that auditing privilege use events (Windows Only) event ID's 576, 577 & 578 will satisfy this?

The way I read AU-3(1), it is asking for audit of when a user (non-privileged or admin) opens an administrative Power Shell or command prompt or (Unix/Linux) other shell/terminal window and executes a command (privileged, because its in an administrative shell). This command should be audited/captured by Solar Winds for later review.

So, my question is this: How do I set up Solar Winds Security Event Manager to provide a report for this type of event?

Thanks for your assistance,

Joe

ecklerwr1

That was just an example of something we added to the out of box SEM experience. I'm working in the same environment as you. I'm not an ISSO/ISSM but do support the tools they use for satisfying DCSA.

Some more examples of added rules: Roxio Secure Burn alert message - Alerts a user to complete all logging requirements when they open Roxio.

Privileged Group: New DTA Member Added or Removed

Privileged Group: New Group Member - Rule fires when any new member is added to an administrative group from a list of groups we consider privileged.

At this time we're not doing everything with reports and functioning more like a SOC. Instead of weekly audits it's daily monitoring.

I will say this the new web based reporting is coming a long way from the old Crystal Reports. So if you're only doing weekly audits that's where you should focus. Also working with the Solarwinds UX team helps to change SEM so it does what we want and need.

Also there are some decent SEM training available under support. Our ISSO's have gotten a pretty good handle on what they need to add and are sharing filters with each other. It would be nice to see a document about 800-53 or 800-171 security controls and which can be done with SEM specifically. Actually there is a doc that lists which tools cover which controls I think but it's all of SolarWinds tools not just SEM (which I wish was updated):

thwack.solarwinds.com/.../fisma-nist-800-53-risk-management-framework-compliance-with-solarwinds-products-updated-november-2019

Bill

ecklerwr1

Also FWIW we use Centrify for logging of full text Privileged Commands which also helps greatly with 2FA for linux and Solaris and also PAM for windows. It essentially give you group policy for Linux and Solaris. I hope to do some integration between Centify and SEM this year.

Bill