Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

From the CLI: ; Verify Session Records: Run the command puresession list to display user session logs. Review the output to ensure Start Time, End Time, Interface, User, Location, and Event fields are being actively recorded. ; Verify Syslog Forwarding: Run the command purelog syslog list to confirm a remote syslog server URI is configured. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an external script is successfully polling the FlashArray REST API for session records.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration for session logs, and establish a process to review logs for weak authentication methods or unexpected access. From the GUI: ; Establish a Review Process: Create a standard operating procedure to regularly review the Session Log pane under Settings > Access specifically looking for unexpected IP locations or failed authentication events. ; To Configure Syslog Forwarding: Navigate to Settings > System. In the Syslog Servers panel, click the + (Create) icon, enter your remote syslog server URI, and click Create.