Ensure that logging is enabled on built-in default security policies

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón

(?m)(?:^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase default-security-rules rules interzone-default log-end yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase default-security-rules rules intrazone-default log-end yes[ \t]*$|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase default-security-rules rules intrazone-default log-end yes[ \t]*$(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase default-security-rules rules interzone-default log-end yes[ \t]*$)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

configure set rulebase default-security-rules rules interzone-default log-end yes set rulebase default-security-rules rules intrazone-default log-end yes commit # CIS guidance: Navigate to Policies > Security Go to default policies intrazone-default and interzone-default. On Actions tab, enable Log at Session End on log setting.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target paloalto