Ensure SMB audit policies with syslog and file log targets are attached to production file systems

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

From the CLI: ; Run the commands purelog file list and purelog syslog list to verify that local and remote log targets exist. ; Run the command purepolicy audit file list to verify that an audit policy exists and its Enabled status is set to True. ; Review the policy members by running purepolicy audit file list --member to ensure the policies are successfully attached to the correct source managed directories.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To align with the security recommendations, establish file log targets, create an audit policy, attach it to your production managed directories, and externally configure SACLs for SMB exports. From the GUI: ; Create the File Log Target: Navigate to Settings > System. In the File Log Targets panel, click the + (Create) icon. Provide a name, select an empty managed directory to store the logs, configure a retention policy (Keep For or Keep Size), and click Create. ; Create the Syslog Target (if not already configured): In the Syslog Servers panel, add your remote syslog server URI. ; Create the Audit Policy: Navigate to Storage > Policies.