Sophos Firewall
TMA-SOPHOS-4.7
Ensure NDR Essentials is enabled and configured
説明
NDR Essentials is a cloud-hosted NDR solution that integrates directly with Sophos firewall. It uses advanced machine learning to detect threats in real-time without impacting the firewall's performance. This provides an additional layer of security in addition to existing firewall protection. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
チェック方法
監査方法: 手動レビュー
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. (Full steps: CIS 4.7.)
修正方法
修正方法: ガイダンスまたは IaC パッチ
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. The default setting is High risk (Score 9 and 10) - Recommended Under Actions, the option is set to Log threats, because NDR Essentials currently only detects and logs threats. Click on Apply
プロパティ
- オペレーティングシステム
- すべて
- タグ
- sophosthreat-prevention
- 参照
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.7 Ensure NDR Essentials is enabled and configured