Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API

MédiaNível 1Revisão manualflasharray

Descrição

FlashArray creates administrative session records for all administrative logins and logouts, whether successful or unsuccessful. Everpure recommends that these logs be monitored via REST API, or sent to configured remote syslog servers in order to detect suspicious or unexpected activity and respond accordingly. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

From the CLI: ; Verify Session Records: Run the command puresession list to display user session logs. Review the output to ensure Start Time, End Time, Interface, User, Location, and Event fields are being actively recorded. ; Verify Syslog Forwarding: Run the command purelog syslog list to confirm a remote syslog server URI is configured. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an external script is successfully polling the FlashArray REST API for session records.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration for session logs, and establish a process to review logs for weak authentication methods or unexpected access. From the GUI: ; Establish a Review Process: Create a standard operating procedure to regularly review the Session Log pane under Settings > Access specifically looking for unexpected IP locations or failed authentication events. ; To Configure Syslog Forwarding: Navigate to Settings > System. In the Syslog Servers panel, click the + (Create) icon, enter your remote syslog server URI, and click Create.

Propriedades

Sistemas operacionais: Qualquer
Tags: flasharraystorageaccess-control
Referência: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.11 Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API