VMware vSphere 7.0 STIG Now Available for Compliance and Alerting in Aria Operations
The United States (U.S.) Department of Defense (DoD) Defense Information Systems Agency (DISA) has officially released the VMware vSphere 7.0 STIG on March 15, 2023. As with previous STIG releases, I have created custom compliance and alerting content for use within Aria Operations. This content covers almost all findings for the Virtual Machine STIG, a large portion of the ESXi STIG, and a select number of items from the vCenter STIG.
My VMware Aria Operations compliance content is broken into two types of downloads. The first is a custom compliance benchmark definition which includes all of the symptom, alert, and recommendation content, as well as a custom compliance benchmark definition. The second set of downloads is the alert/symptom/recommendation content for each component (virtual machine, ESX, vCenter application). The content can be downloaded from the Downloads page on this site.
I have attempted to include automated compliance checks for as many of these components as possible. Unfortunately, only a subset of the compliance checks are included due to limitations in the data collected by Aria Operations or requirements that manual verifications be completed for various components. I have noted the excluded checks within the notes for each of the VMware Aria Operations alerts.
The following VMware vSphere 7.0 STIG components are included in my VMware Aria Operations compliance content downloads:
* Virtual Machine STIG
* ESXi STIG
* vCenter STIG
My compliance content includes custom benchmark definitions for each of these components, as well as alert/symptom/recommendation content for each component. The content is designed to be used within Aria Operations to provide automated compliance checks and alerting for VMware vSphere 7.0 environments.
Included in the downloads are custom compliance benchmark definitions for each of the components, as well as alert/symptom/recommendation content for each component. The content is designed to be used within Aria Operations to provide automated compliance checks and alerting for VMware vSphere 7.0 environments.
The following checks are not included in my compliance content downloads due to limitations in the data collected by Aria Operations or requirements that manual verifications be completed for various components:
* Checks that require manual verification, such as software updates and patches, cannot be automated and must be completed manually.
* Checks that are not supported by Aria Operations, such as network configuration and access controls, cannot be included in the compliance content.
To download the custom compliance benchmark definitions and alert/symptom/recommendation content for VMware vSphere 7.0, please visit the Downloads page on this site. I will continue to update and expand my compliance content as new components and features are released by VMware.
Please note that the use of these custom compliance benchmark definitions and alert/symptom/recommendation content is at your own risk. I cannot guarantee the accuracy or completeness of the content, and it is recommended that you thoroughly test and validate any changes before deploying them in a production environment.