Alibaba Cloud
TMA-ALIBABA-2.9
Ensure Security Center Network, Host and Security log analysis is enabled
Descripción
Log Service collects log entries of Security Center for security logs, network logs, and host logs, with 14 subtypes, including 1. Security logs a. Vulnerability logs b. Baseline logs c. Security alerting logs 2. Security logs a. Vulnerability logs b. Baseline logs c. Security alerting logs 3. Network logs a. The Security Center log shall be enabled to collect and store real-time security log, network log and server log to better protect your assets in real time. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
Cómo se verifica
Método de auditoría: Revisión manual
Perform the following ensure the Cloud Firewall access and security log is enabled: 1. Logon to Security Center Console. 2. In the left-side navigation pane, select Investigation > Log Analysis to enter the Activate Log Analysis page. 3. In the Activate Log Analysis page, ensure the switch for the specific log type are turned on. 4. Ensure the log volume usage indicator is not exhausted.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Perform the following ensure the Cloud Firewall access and security log is enabled: 1. Logon to Security Center Console. 2. In the left-side navigation pane, select Investigation > Log Analysis to enter the Activate Log Analysis page. 3. Click Active Now on the Activate log Analysis page. 4. On the Purchase page, check Full Log and configure some other settings as needed. 5. Click Purchase Now. 6. In the Activate log Analysis click Activate log Analysis to complete the authorization. 7. In the log type menu, check the log types to enable the log collection.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- alibabalogging
- Referencia
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 2.9 Ensure Security Center Network, Host and Security log analysis is enabled