Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API

MédiaNível 1Revisão manualflasharray

Descrição

FlashArray creates administrative audit records for all administrative operations that cause a change to the system configuration or state. Everpure recommends that these logs be monitored via REST API, or sent to configured remote syslog servers in order to detect suspicious or unexpected activity and respond accordingly. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

From the CLI: ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm a remote syslog server URI is configured. ; Verify Audit Records: Run the command pureaudit list (or pureaudit list -- filter "time >= '<YYYY-MM-DD>'" for recent events). Review the output to ensure the Time, User, Command, and Arguments are being accurately recorded. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an active external script or tool is successfully authenticating and pulling the audit logs via the FlashArray REST API.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration, and establish a process to review unexpected configurations. From the GUI: ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, click the + (Create) icon. ; Enter the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and click Create. ; To Configure REST API Monitoring: ; Integrate your SIEM or monitoring tool using the Pure Storage REST API endpoints to continuously poll for audit trail events.

Propriedades

Sistemas operacionais: Qualquer
Tags: flasharraystorageaccess-control
Referência: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.10 Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API