Ensure SMB audit policies with syslog and file log targets are attached to production file systems

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

From the CLI: ; Run the commands purelog file list and purelog syslog list to verify that local and remote log targets exist. ; Run the command purepolicy audit file list to verify that an audit policy exists and its Enabled status is set to True. ; Review the policy members by running purepolicy audit file list --member to ensure the policies are successfully attached to the correct source managed directories.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To align with the security recommendations, establish file log targets, create an audit policy, attach it to your production managed directories, and externally configure SACLs for SMB exports. From the GUI: ; Create the File Log Target: Navigate to Settings > System. In the File Log Targets panel, click the + (Create) icon. Provide a name, select an empty managed directory to store the logs, configure a retention policy (Keep For or Keep Size), and click Create. ; Create the Syslog Target (if not already configured): In the Syslog Servers panel, add your remote syslog server URI. ; Create the Audit Policy: Navigate to Storage > Policies.