TMA-IBMCLOUD-3.4
Ensure alerts are defined on custom views to notify of unauthorized requests, critical account actions, and high-impact operations in your account
설명
Events that you collect and centralize in the IBM Cloud Logs service provide information about actions that take place on your account. You can define alerts to notify promptly of problems, anomalies, and abnormal situations. Each event reports information about who requested an action on your account (initiator details), what action was requested, the resource on which the action was requested (target details), and outcome of the request. Each event is based on the Cloud Auditing Data Federation (CADF) standard. For more information about the IBM event definition, see Event types and Event fields. In IBM Cloud Activity Tracker Event Routing, events from core IBM Cloud platform services are collected automatically and can be routed to a destination for analysis such as the IBM Cloud Logs service instances in your account. Events are also collected automatically for enabled-AT services...
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Use the following checklist to ensure alerts are defined on custom views to notify of unauthorized requests, critical account actions, and high-impact operations in your account. This checklist assumes that you have a different IBM Cloud account for development, staging, Q&A, and production. The checklist must be applied to each environment independently. In IBM Cloud Logs, you configure alerts that define the triggering conditions on filtered data on which you want to be notified. In IBM Cloud Event Notifications, you configure the destinations where you want to be notified for an alert and the conditions that define to which destination an event is routed. You can route events to one or more destinations based on conditions that you configure. You can notify to a service destination such as a webhook or PagerDuty, or to a human destination such as email or slack. To check and confirm that alerts are correctly configured, perform the following checks: 1. Verify the outbound connection from IBM Cloud Logs to the IBM Cloud Event Notifications service. a. First, complete the following steps in the Event Notifications instance: i. Verify the source with name IBM Cloud Logs - <CLOUD...
조치 방법
조치 방식: 가이드 또는 인프라 패치
UI instructions that you can use to create alerts on custom views: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Go to the Menu icon. Then, select Observability to access the Observability dashboard. 3. Click Logging. By default Instances are displayed. 4. Click the Cloud Logs tab. 5. The list of instances that are available on IBM Cloud is displayed. If the instances are not displayed, click Instances, Cloud Logs to display the list of logging instances. 6. Click Open dashboard for your selected instance. 7. Configure alerts for any missing alerts. UI Instructions that you can use to create missing outbound integration to connect IBM Cloud Logs with IBM Cloud Event Notifications: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. In the console, click the Navigation Menu icon, Resource list. 3. Select your instance of IBM Cloud Logs. 4. In the IBM Cloud Logs navigation, click the Integrations icon, Outbound integrations. 5. In the outbound integrations section, find Event Notifications and click Add. 6. On the Integrations page, click Add new. 7. If an IAM authorization between IBM Cloud Logs and Event Notifications doesn't exist in your account, you must configure one b...
속성
- 운영 체제
- 모두
- 태그
- authcloudibmcloud
- 참고 자료
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 3.4 Ensure alerts are defined on custom views to notify of unauthorized requests, critical account actions, and high-impact operations in your account