TMA-FLASHARRAY-4.3
Ensure an enabled snapshot policy taking at least one daily snapshot is attached to every directory
설명
FlashArray supports creating snapshot policies for automatically creating, managing, and deleting immutable snapshots of FlashArray directories. These policies can be additionally used to replicate file snapshots. Everpure recommends the following if you have any file systems on the system: ; Attach at least one enabled snapshot policy to each directory. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From the CLI: ; Run the command purepolicy snapshot rule list to verify the configured rules on your snapshot policies. ; Review the output to ensure the frequency (every) is at least daily (1d) and the retention (keep_for) is at least 7 days (7d or 1w). ; Run the command purepolicy snapshot list --member to view all configured snapshot policies and verify that your production managed directories are successfully attached to them.
조치 방법
조치 방식: 가이드 또는 인프라 패치
To align with the security recommendations, establish a snapshot policy that takes daily snapshots with a 7-day retention period, and attach it to your file system managed directories. From the GUI: ; Navigate to Protection > Policies. ; In the Snapshot Policies panel, click the + (Create Policy) icon. Provide a name, ensure the Enabled toggle is active (blue), and click Create. ; Click on the newly created policy name to open its details. ; In the Rules panel, click the + (Create Rule) icon (or menu icon > Create...) to add a new rule. ; Set Create 1 snapshot every to 1d (or a shorter interval like 12h). ; Set And keep for to 1w (or 7d or a longer duration like 30d).
속성
- 운영 체제
- 모두
- 태그
- flasharraystoragedata-protection
- 참고 자료
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 4.3 Ensure an enabled snapshot policy taking at least one daily snapshot is attached to every directory