Ensure notification is configured to send system and security events

MediumLevel 1Manual reviewsophos

Description

This recommendation ensures that administrator receives notification on system events, reports and security incidents either via email or SNMP Traps. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Navigate to 'System > Administration > Notification settings > Mail server settings'. Verify that 'Send notification via > Built-in email server' or 'External email server' is checked and configure email settings appropriately. Navigate to 'Configure > System services > Notification list'. Verify that appropriate admin, system and security events are checked to send email notification and/or SNMP traps.

How it is fixed

Fix method: Guidance or infrastructure patch

Navigate to 'System > Administration > Notification settings'. When 'built-in email server' is used. Set the 'from email address' of the sender. Set the 'Send notifications to email address' of the administrators' email address. Set 'Management interface IP address' to send notification from. When 'External mail server' is used. Set the 'Mail server IPv4 address/FQDN – Port' is set to the outgoing mail server. Set 'username' and 'password' to authenticate to the outgoing mail server. Set 'connection security' to 'STARTTLS' or 'SSL/TLS'. Navigate to 'Configure > System services > Notification list'. Set the appropriate admin, system and security events to send email notification and/or SNMP traps.

Properties

Operating systems: Any
Tags: sophoslogging
Reference: CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.2.2 Ensure notification is configured to send system and security events