Ensure static REST API tokens are used only when necessary and configured to expire periodically

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

From the CLI: ; Run the command pureadmin list --api-token to list all accounts and their API token status. ; Review the Created and Expires columns to identify tokens that lack an expiration date (indicated by a -) or have existed longer than the organization's rotation policy allows. ; Verify that each token-holding account is assigned the minimum required management access policy.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To align with the security recommendations, delete unauthorized or stale API tokens, and ensure that any newly issued tokens are configured with a strict validity period (timeout) so they expire automatically. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit icon for the user you want to modify. ; To delete a token: Select Remove API Token... and click Remove to confirm. ; To rotate or create an expiring token: Select Create API Token... (or Recreate API Token... to overwrite an existing one). In the prompt, enter a validity period in the Expires In field so the token does not live indefinitely, then click Create. From the CLI: