Ensure at least one alert watcher is configured to receive alerts of all severities

MédiaNível 1Automatizadaflasharray

Descrição

FlashArray allows configuration of one or more alert watchers, which are email addresses that will receive emails for new system alerts. The minimum severity of alerts that will be sent to each watcher is also configurable. Passes when an enabled alert watcher other than the built-in purestorage.com address exists and a watcher rule sets Minimum Notification Severity to info. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purealert watcher list --nvp; purepolicy alert-watcher rule list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Como é verificado

Método de auditoria: Padrão de configuração

Padrão: (?is)(?:(?m:^|\s)(?:name[ \t]*[=:]?[ \t]*)?[^\s@=]+@(?:[^p\s]\S*|p[^u\s]\S*|pu[^r\s]\S*|pur[^e\s]\S*|pure[^s\s]\S*|pures[^t\s]\S*|purest[^o\s]\S*|puresto[^r\s]\S*|purestor[^a\s]\S*|purestora[^g\s]\S*|purestorag[^e\s]\S*|purestorage[^\.\s]\S*|purestorage\.[^c\s]\S*|purestorage\.c[^o\s]\S*|purestorage\.co[^m\s]\S*|p|pu|pur|pure|pures|purest|puresto|purestor|purestora|purestorag|purestorage|purestorage\.|purestorage\.c|purestorage\.co|purestorage\.com\S+)\s+(?:enabled[ \t]*[=:]?[ \t]*)?true\b.*min(?:imum)?[ _-]?notification[ _-]?severity[ \t]*[=:]?[ \t]*info|min(?:imum)?[ _-]?notification[ _-]?severity[ \t]*[=:]?[ \t]*info.*(?m:^|\s)(?:name[ \t]*[=:]?[ \t]*)?[^\s@=]+@(?:[^p\s]\S*|p[^u\s]\S*|pu[^r\s]\S*|pur[^e\s]\S*|pure[^s\s]\S*|pures[^t\s]\S*|purest[^o\s]\S*|puresto[^r\s]\S*|purestor[^a\s]\S*|purestora[^g\s]\S*|purestorag[^e\s]\S*|purestorage[^\.\s]\S*|purestorage\.[^c\s]\S*|purestorage\.c[^o\s]\S*|purestorage\.co[^m\s]\S*|p|pu|pur|pure|pures|purest|puresto|purestor|purestora|purestorag|purestorage|purestorage\.|purestorage\.c|purestorage\.co|purestorage\.com\S+)\s+(?:enabled[ \t]*[=:]?[ \t]*)?true\b)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, configure an organizational email address to monitor array alerts. From the GUI: ; Navigate to Settings > System and select Alerts and Notifications. ; In the Alert Watchers panel, click the + (Create) icon, enter the desired email address, and click Create. ; To adjust the notification level, click the More Options menu next to the newly created watcher, select Edit, choose the minimum severity, and click Save. ; Ensure the Enabled switch is toggled on. From the CLI: ; Create the watcher: Run the purealert watcher create command. ; Command Syntax: purealert watcher create <EMAIL_ADDRESS>

Propriedades

Sistemas operacionais: Qualquer
Tags: flasharraystorageaccess-control
Referência: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.13 Ensure at least one alert watcher is configured to receive alerts of all severities

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target flasharray