TMA-FLASHARRAY-4.3
Ensure an enabled snapshot policy taking at least one daily snapshot is attached to every directory
Description
FlashArray supports creating snapshot policies for automatically creating, managing, and deleting immutable snapshots of FlashArray directories. These policies can be additionally used to replicate file snapshots. Everpure recommends the following if you have any file systems on the system: ; Attach at least one enabled snapshot policy to each directory. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
From the CLI: ; Run the command purepolicy snapshot rule list to verify the configured rules on your snapshot policies. ; Review the output to ensure the frequency (every) is at least daily (1d) and the retention (keep_for) is at least 7 days (7d or 1w). ; Run the command purepolicy snapshot list --member to view all configured snapshot policies and verify that your production managed directories are successfully attached to them.
How it is fixed
Fix method: Guidance or infrastructure patch
To align with the security recommendations, establish a snapshot policy that takes daily snapshots with a 7-day retention period, and attach it to your file system managed directories. From the GUI: ; Navigate to Protection > Policies. ; In the Snapshot Policies panel, click the + (Create Policy) icon. Provide a name, ensure the Enabled toggle is active (blue), and click Create. ; Click on the newly created policy name to open its details. ; In the Rules panel, click the + (Create Rule) icon (or menu icon > Create...) to add a new rule. ; Set Create 1 snapshot every to 1d (or a shorter interval like 12h). ; Set And keep for to 1w (or 7d or a longer duration like 30d).
Properties
- Operating systems
- Any
- Tags
- flasharraystoragedata-protection
- Reference
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 4.3 Ensure an enabled snapshot policy taking at least one daily snapshot is attached to every directory