Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

From the CLI: ; Verify Session Records: Run the command puresession list to display user session logs. Review the output to ensure Start Time, End Time, Interface, User, Location, and Event fields are being actively recorded. ; Verify Syslog Forwarding: Run the command purelog syslog list to confirm a remote syslog server URI is configured. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an external script is successfully polling the FlashArray REST API for session records.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration for session logs, and establish a process to review logs for weak authentication methods or unexpected access. From the GUI: ; Establish a Review Process: Create a standard operating procedure to regularly review the Session Log pane under Settings > Access specifically looking for unexpected IP locations or failed authentication events. ; To Configure Syslog Forwarding: Navigate to Settings > System. In the Syslog Servers panel, click the + (Create) icon, enter your remote syslog server URI, and click Create.