Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server

СредњаНиво 2Ручни прегледsophos

Опис

Sophos Firewall provides extensive logging capabilities for traffic, system, and network protection functions. You can use logs to analyze network activity to help identify security issues and reduce network abuse. You can store logs locally, send them to Sophos Central, or send them to third-party syslog servers. You can select logs to store or send by module or feature, or you can select all logs. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Navigate to 'Protect > Rules and policies'. Verify the configured Firewall rules and ensure 'Log firewall traffic' is checked. Navigate to 'Configure > System services > Log settings'. Verify that external syslog server is configured and sending system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. (Full steps: CIS 3.7.)

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Navigate to 'Protect > Rules and policies'. Set 'Log firewall traffic' is checked for configured firewall rules. Navigate to 'Configure > System services > Log settings'. Configure external syslog server and set to send system, security events to external syslog server. Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs and Consolidated troubleshooting report' You can download individual log files or download a consolidated log file. Sophos Firewall helps you record the changes administrators make on the web admin console or CLI, via the configuration-audit.logs Navigate to 'Monitor & Analyze > Diagnostics > Tools > Troubleshooting logs > configuration-audit.log'

Својства

Оперативни системи: Било који
Ознаке: sophoslogging
Референца: CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.7 Ensure Logging is enabled on firewall rules and configured to send logs to the external syslog server