TMA-IBMCLOUD-3.2
Ensure data retention for audit events
Description
Create Cloud Object Storage buckets for long-term storage of all audit log events so that you have access to data for a longer period of time, you can comply with highly regulated environments, you can recover quickly in the eventuality of a disaster scenario, and you can adhere to internal data storage policies. When you provision an instance of IBM Cloud Logs, you must have an IBM Cloud Object Storage (COS) instance in the same account where your IBM Cloud Logs instance is provisioned. Cloud Logs supports having all logs go to the COS bucket, and also has Priority Insights, which provides enhanced interaction with the logs. However, Priority Insights does not provide long-term storage. As such, it is important to ensure that a Cloud Object Storage bucket has been created and that all data is stored there, in addition to any optional use of Priority Insights. The maximum number of da...
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
Use the following check list to ensure that long-term retention is configured for each of your Cloud Logs instances: 1. Ensure that IBM Cloud Logs instances are provisioned in a region that also contains one or more Cloud Object Storage buckets to configure long-term storage to an external storage service. 2. Ensure that each IBM Cloud Logs has a COS bucket enabled and configured. a. Log in to IBM Cloud at https://cloud.ibm.com. b. From the Menu bar, select Observability. c. Select Logging, Instances. You might need to click the Cloud Logs tab to see your IBM Cloud Logs instances. d. Select the instance to which you want to verify a data bucket. e. In the Storage section, confirm the Bucket CRN, and the Bucket endpoint. 3. Ensure that you have access to storage, for example, check that you have an instance of the IBM Cloud Object Storage service provisioned in your account. You must define a service to service (S2S) authorization between IBM Cloud Logs and IBM Cloud Object Storage to allow IBM Cloud Logs to read and write data into the data bucket. For more information, see Creating a S2S authorization to grant access to a bucket. 4. Ensure that you have COS buckets available to...
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
1. If the Cloud Logs instance cannot connect to the Cloud Object Storage bucket, you must define a service to service (S2S) authorization between IBM Cloud Logs and IBM Cloud Object Storage to allow IBM Cloud Logs to read and write data into the data bucket. For more information, see Creating a S2S authorization to grant access to a bucket. 2. If no Data Bucket is defined, you must define the Data Bucket within Cloud Logs as follows: a. Log in to IBM Cloud at https://cloud.ibm.com. b. From the Menu bar, select Observability. c. Select Logging, Instances. You might need to click the Cloud Logs tab to see your IBM Cloud Logs instances. d. Select the instance to which you want to configure a data bucket. e. In the Storage section, click edit. f. In the Logs data section, configure the Bucket CRN, and the Bucket endpoint. - Select Insert CRN from search to get the list of buckets in your account. You can choose a CRN from the list. - Select View endpoints in docs to find the endpoints per location. Choose the endpoint based on your bucket configuration. g. Click Save to save the configuration. 3. If no Metrics Bucket is defined, you must define the Data Bucket within Cloud Logs as f...
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- cloudibmcloudlogging
- Référence
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 3.2 Ensure data retention for audit events