Ensure SMB audit policies with syslog and file log targets are attached to production file systems

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

From the CLI: ; Run the commands purelog file list and purelog syslog list to verify that local and remote log targets exist. ; Run the command purepolicy audit file list to verify that an audit policy exists and its Enabled status is set to True. ; Review the policy members by running purepolicy audit file list --member to ensure the policies are successfully attached to the correct source managed directories.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To align with the security recommendations, establish file log targets, create an audit policy, attach it to your production managed directories, and externally configure SACLs for SMB exports. From the GUI: ; Create the File Log Target: Navigate to Settings > System. In the File Log Targets panel, click the + (Create) icon. Provide a name, select an empty managed directory to store the logs, configure a retention policy (Keep For or Keep Size), and click Create. ; Create the Syslog Target (if not already configured): In the Syslog Servers panel, add your remote syslog server URI. ; Create the Audit Policy: Navigate to Storage > Policies.