Ensure SMB audit policies with syslog and file log targets are attached to production file systems

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

From the CLI: ; Run the commands purelog file list and purelog syslog list to verify that local and remote log targets exist. ; Run the command purepolicy audit file list to verify that an audit policy exists and its Enabled status is set to True. ; Review the policy members by running purepolicy audit file list --member to ensure the policies are successfully attached to the correct source managed directories.

How it is fixed

Fix method: Guidance or infrastructure patch

To align with the security recommendations, establish file log targets, create an audit policy, attach it to your production managed directories, and externally configure SACLs for SMB exports. From the GUI: ; Create the File Log Target: Navigate to Settings > System. In the File Log Targets panel, click the + (Create) icon. Provide a name, select an empty managed directory to store the logs, configure a retention policy (Keep For or Keep Size), and click Create. ; Create the Syslog Target (if not already configured): In the Syslog Servers panel, add your remote syslog server URI. ; Create the Audit Policy: Navigate to Storage > Policies.