TMAegis
de
Weitere Regeln für sophos

Sophos Firewall

TMA-SOPHOS-3.7

Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server

MittelStufe 2Manuelle Prüfungsophos

Beschreibung

Sophos Firewall provides extensive logging capabilities for traffic, system, and network protection functions. You can use logs to analyze network activity to help identify security issues and reduce network abuse. You can store logs locally, send them to Sophos Central, or send them to third-party syslog servers. You can select logs to store or send by module or feature, or you can select all logs. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Navigate to 'Protect > Rules and policies'. Verify the configured Firewall rules and ensure 'Log firewall traffic' is checked. Navigate to 'Configure > System services > Log settings'. Verify that external syslog server is configured and sending system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. (Full steps: CIS 3.7.)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Navigate to 'Protect > Rules and policies'. Set 'Log firewall traffic' is checked for configured firewall rules. Navigate to 'Configure > System services > Log settings'. Configure external syslog server and set to send system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. Sophos Firewall helps you record the changes administrators make on the web admin console or CLI, via the configuration-audit.logs Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs > configuration-audit.log'

Eigenschaften

Betriebssysteme
Beliebig
Tags
sophoslogging
Referenz
CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.7 Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server