Ensure that Logstore data retention period is set 365 days or greater

MediumLevel 2Manual reviewalibaba

Description

Ensure Activity Log Retention is set for 365 days or greater Logstore life cycle controls how your activity log is exported and retained. It is recommended to retain your activity log for 365 days or more in order to have time to respond to any incidents. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Perform below steps to ensure the log retention is set to 365 days or greater. 1. Logon to SLS Console. 2. In the Projects section, click the target project name. On the page that appears, click the plus sign (+) next to the search box. 3. In the dialog box that appears, check whether the Permanent Storage is turned on, which means the log data will be stored permanently, or else 4. Ensure the Data Retention Period is set to 365 or greater.

How it is fixed

Fix method: Guidance or infrastructure patch

Perform below steps to ensure the log retention is set to 365 days or greater. 1. Logon to SLS Console. 2. Find the project in the Projects section, and then click the target project name. 3. On the page that appears, click Modify a Logstore icon next to the Logstore, and then choose Modify. 4. On the page that appears, click Modify, modify the Data Retention Period, to 365 or greater and then click Save.

Properties

Operating systems: Any
Tags: alibabalogging
Reference: CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 2.23 Ensure that Logstore data retention period is set 365 days or greater