Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

From the CLI: ; Verify Session Records: Run the command puresession list to display user session logs. Review the output to ensure Start Time, End Time, Interface, User, Location, and Event fields are being actively recorded. ; Verify Syslog Forwarding: Run the command purelog syslog list to confirm a remote syslog server URI is configured. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an external script is successfully polling the FlashArray REST API for session records.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration for session logs, and establish a process to review logs for weak authentication methods or unexpected access. From the GUI: ; Establish a Review Process: Create a standard operating procedure to regularly review the Session Log pane under Settings > Access specifically looking for unexpected IP locations or failed authentication events. ; To Configure Syslog Forwarding: Navigate to Settings > System. In the Syslog Servers panel, click the + (Create) icon, enter your remote syslog server URI, and click Create.