Sophos Firewall
TMA-SOPHOS-3.7
Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server
Description
Sophos Firewall provides extensive logging capabilities for traffic, system, and network protection functions. You can use logs to analyze network activity to help identify security issues and reduce network abuse. You can store logs locally, send them to Sophos Central, or send them to third-party syslog servers. You can select logs to store or send by module or feature, or you can select all logs. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
How it is checked
Audit method: Manual review
Navigate to 'Protect > Rules and policies'. Verify the configured Firewall rules and ensure 'Log firewall traffic' is checked. Navigate to 'Configure > System services > Log settings'. Verify that external syslog server is configured and sending system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. (Full steps: CIS 3.7.)
How it is fixed
Fix method: Guidance or infrastructure patch
Navigate to 'Protect > Rules and policies'. Set 'Log firewall traffic' is checked for configured firewall rules. Navigate to 'Configure > System services > Log settings'. Configure external syslog server and set to send system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. Sophos Firewall helps you record the changes administrators make on the web admin console or CLI, via the configuration-audit.logs Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs > configuration-audit.log'
Properties
- Operating systems
- Any
- Tags
- sophoslogging
- Reference
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.7 Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server