TMA-OPNSENSE-6.3
Ensure Remote Syslog is Configured
MediumLevel 1Manual reviewopnsense
Description
OPNsense must forward logs to a remote log server or SIEM using syslog. Local-only logs can be erased during compromise and are not sufficient for enterprise IR.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
1. Navigate to System → Settings → Logging / Targets (or Syslog depending on build) 2. Confirm at least one remote syslog target exists. 3. Confirm logs are received by the SIEM.
How it is fixed
Fix method: Guidance or infrastructure patch
1. Navigate to System → Settings → Logging / Targets (or Syslog depending on build) 2. Configure syslog target(s) to an enterprise log platform.
Properties
- Operating systems
- Any
- Tags
- loggingopnsense
- Reference
- CIS OPNsense Benchmark v1.0.0 - 6.3 Ensure Remote Syslog is Configured