Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

From the CLI: ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm a remote syslog server URI is configured. ; Verify Audit Records: Run the command pureaudit list (or pureaudit list -- filter "time >= '<YYYY-MM-DD>'" for recent events). Review the output to ensure the Time, User, Command, and Arguments are being accurately recorded. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an active external script or tool is successfully authenticating and pulling the audit logs via the FlashArray REST API.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration, and establish a process to review unexpected configurations. From the GUI: ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, click the + (Create) icon. ; Enter the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and click Create. ; To Configure REST API Monitoring: ; Integrate your SIEM or monitoring tool using the Pure Storage REST API endpoints to continuously poll for audit trail events.