Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

From the CLI: ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm a remote syslog server URI is configured. ; Verify Audit Records: Run the command pureaudit list (or pureaudit list -- filter "time >= '<YYYY-MM-DD>'" for recent events). Review the output to ensure the Time, User, Command, and Arguments are being accurately recorded. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an active external script or tool is successfully authenticating and pulling the audit logs via the FlashArray REST API.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration, and establish a process to review unexpected configurations. From the GUI: ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, click the + (Create) icon. ; Enter the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and click Create. ; To Configure REST API Monitoring: ; Integrate your SIEM or monitoring tool using the Pure Storage REST API endpoints to continuously poll for audit trail events.