Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

From the CLI: ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm a remote syslog server URI is configured. ; Verify Audit Records: Run the command pureaudit list (or pureaudit list -- filter "time >= '<YYYY-MM-DD>'" for recent events). Review the output to ensure the Time, User, Command, and Arguments are being accurately recorded. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an active external script or tool is successfully authenticating and pulling the audit logs via the FlashArray REST API.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration, and establish a process to review unexpected configurations. From the GUI: ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, click the + (Create) icon. ; Enter the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and click Create. ; To Configure REST API Monitoring: ; Integrate your SIEM or monitoring tool using the Pure Storage REST API endpoints to continuously poll for audit trail events.