Syslog logging should be configured

Как проверяется

Метод проверки: Шаблон конфигурации

Шаблон

(?m)(?:^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?log-settings syslog (?:"[^"\n]*"|\S+) server (?:"[^"\n]*"|\S+) server \S+(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?log-settings system match-list (?:"[^"\n]*"|\S+) send-syslog \S+|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?log-settings system match-list (?:"[^"\n]*"|\S+) send-syslog \S+(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?log-settings syslog (?:"[^"\n]*"|\S+) server (?:"[^"\n]*"|\S+) server \S+)

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

configure set shared log-settings syslog SYSLOG-PROFILE server SYSLOG1 server 10.0.0.50 transport UDP port 514 facility LOG_USER format BSD set shared log-settings system match-list ALL-SYSTEM filter "All Logs" send-syslog SYSLOG-PROFILE set shared log-settings config match-list ALL-CONFIG filter "All Logs" send-syslog SYSLOG-PROFILE set shared log-settings userid match-list ALL-USERID filter "All Logs" send-syslog SYSLOG-PROFILE set shared log-settings hipmatch match-list ALL-HIP filter "All Logs" send-syslog SYSLOG-PROFILE set shared log-settings iptag match-list ALL-IPTAG filter "All Logs" send-syslog SYSLOG-PROFILE commit # CIS guidance: Navigate to Device > Server Profiles > Syslog Choose Add Assign a Name to the Profile. Choose Add, and assign a server name in the Name field, add an IP address or FQDN in the Syslog Server field. Edit other fields as appropriate for your server. Repeat if multiple Syslog destinations are required. Navigate to Device > Log Settings Under System, add an entry. Define a Name and a Filter setting. Under Forward Methods, add a Syslog Profile in the Syslog section. Ensure that at least one of the Log Settings Configuration entries has it's Filter setting at All Logs Under Configuration, add an entry. Define a Name and a Filter setting. Under Forward Methods, add a Syslog Profile in the Syslog section. Ensure that at least one of the Log Settings Configuration entries has it's Filter setting at All Logs Under User-ID, add an entry. Define a Name and a Filter setting. Under Forward Methods, add a Syslog Profile in the Syslog section. Ensure that at least one of the Log Settings Configuration entries has it's Filter setting at All Logs Under HIP Match (Host Information Profile), add an entry. Define a Name and a Filter setting. Under Forward Methods, add a Syslog Profile in the Syslog section. Ensure that at least one of the Log Settings Configuration entries has it's Filter setting at All Logs Under IP-Tag, add an entry. Define a Name and a Filter setting. Under Forward Methods, add a Syslog Profile in the Syslog section. Ensure that at least one of the Log Settings Configuration entries has it's Filter setting at All Logs

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

tmaegis scan --target paloalto