TMA-FLASHARRAY-1.12
Ensure system alerts are actively monitored via remote syslog or email alert watchers
설명
FlashArray creates alerts for a variety of system conditions that may be cause for concern. Not all of these are security related, but a number of them are either directly security related or can have an impact on security. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From the CLI: ; Verify Alert Watchers (Email): Run the command purealert watcher list. Review the output to ensure that an internal organization email address is configured and enabled to receive notifications. ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm that a remote syslog server URI is actively configured to receive events (which includes purity.alert records).
조치 방법
조치 방식: 가이드 또는 인프라 패치
To align with the security recommendations, implement a continuous alerting process by configuring an email alert watcher or remote syslog forwarding (or both). From the GUI: ; To Configure Alert Watchers (Email): ; Navigate to Settings > System and select Alerts and Notifications in the navigation pane. ; Add the appropriate internal email address for your organization's monitoring or administrative team to receive alert notifications. ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, create a syslog server by entering the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and saving the configuration. From the CLI:
속성
- 운영 체제
- 모두
- 태그
- flasharraystorageaccess-control
- 참고 자료
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.12 Ensure system alerts are actively monitored via remote syslog or email alert watchers