Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server

СреднийУровень 2Ручная проверкаsophos

Описание

Sophos Firewall provides extensive logging capabilities for traffic, system, and network protection functions. You can use logs to analyze network activity to help identify security issues and reduce network abuse. You can store logs locally, send them to Sophos Central, or send them to third-party syslog servers. You can select logs to store or send by module or feature, or you can select all logs. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Navigate to 'Protect > Rules and policies'. Verify the configured Firewall rules and ensure 'Log firewall traffic' is checked. Navigate to 'Configure > System services > Log settings'. Verify that external syslog server is configured and sending system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. (Full steps: CIS 3.7.)

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Navigate to 'Protect > Rules and policies'. Set 'Log firewall traffic' is checked for configured firewall rules. Navigate to 'Configure > System services > Log settings'. Configure external syslog server and set to send system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. Sophos Firewall helps you record the changes administrators make on the web admin console or CLI, via the configuration-audit.logs Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs > configuration-audit.log'

Свойства

Операционные системы: Любая
Теги: sophoslogging
Источник: CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.7 Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server