Alibaba Cloud
TMA-ALIBABA-2.7
Ensure Web Application Firewall access and security log service is enabled
Description
Log Service collects log entries that record visits to and attacks on websites that are protected by Alibaba Cloud Web Application Firewall (WAF), and supports real-time log query and analysis. The query results are centrally displayed in dashboards. The WAF access and security log shall be enabled to enable timely analytical investigation on visits to and attacks on your websites and help security engineers to develop protection strategies. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
How it is checked
Audit method: Manual review
Perform the following ensure the WAF access and security log is enabled: 1. Logon to WAF Console. 2. Choose App Market > App Management. 3. Click Configure in Real-time Log Query and Analysis Service. 4. On Log Service page, select the specific domain name of your website. 5. Ensure the Status switch on the right is turned on. 6. Ensure the log volume usage indicator is sufficient for log storage.
How it is fixed
Fix method: Guidance or infrastructure patch
Perform the following ensure the Anti-DDoS access and security log is enabled: 1. Logon to WAF Console. 2. Choose App Market > App Management. 3. Select the region where your WAF instance is located. 4. Click Upgrade in Real-time Log Query and Analysis Service. 5. Enable Log Service. 6. Select the log storage period and the log storage size, and click Buy Now. 7. Return to the WAF Console and choose App Market > App Management, and then click Authorize in Real-time Log Query and Analysis Service. 8. Click Agree to authorize WAF to write log entries to your exclusive logstore. 9.
Properties
- Operating systems
- Any
- Tags
- alibabalogging
- Reference
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 2.7 Ensure Web Application Firewall access and security log service is enabled