v5 - FTP_ITC.1/INTER_XFER_IT audit records to primary MDM from subordinate

[woodbe]

What if the configuration of the subordinate MDM is to provide all audit events to the primary which can then share them to the audit server instead of having the subordinate provide them directly to the audit server?

For a distributed TOE, it isn't required that all components send logs to the audit server, they can go through the "central" node whatever that is and send them. Could this work for the subordinate MDM as well, where the events are all forwarded to the primary? Since the primary would likely have a connection by default, can the subordinate use the primary as the proxy?

[crpezol]

Conceptually I don't see an issue with that, since the audit records should be protected along the chain to the audit server. In practice I'm thinking that this would be a rare case between Primary and Subordinate since most likely these will be two separate TOEs from two separate vendors. The audit records in this case are TOE audit records and I can't see a vendor sending all the audit records from their product to another vendor, especially if the subordinate is a cloud product.

[woodbe]

Yeah, my expectation here is really that my subordinate MDM really only knows to talk to the primary and sends everything there, not that it would be configured to send most stuff to the primary but then be configured separately to send logs to yet another server/service.