Ensure production volumes and hosts are protected by ratcheted (SafeMode) protection groups with daily snapshots

中级别 1人工审核flasharray

说明

FlashArray allows for protection groups (pgroups) to be created. These pgroups can be attached to hosts and volumes in order to schedule the creation and replication of snapshots for the purpose of data protection. Additionally, pgroups may be ratcheted to enable a feature known as SafeMode. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

From the CLI: ; Run the commands purevol list --protect (and purehost list --protect) to verify that your production workloads are actively associated with a protection group. ; Run the command purepgroup list --retention-lock to verify the SafeMode status is ratcheted for your production protection groups. ; Run the commands purepgroup list --schedule and purepgroup list -- retention to verify that the snapshot and replication frequencies are at least daily and retained for at least 7 days.

修复方式

修复方法: 操作指南或基础设施补丁

To align with the security recommendations, create a volume-based protection group, establish daily snapshot and replication schedules with at least 7 days of retention, and ratchet the group to enable SafeMode. From the GUI: ; Navigate to Protection > Protection Groups. ; In the Source Protection Groups panel, click the + (Create Protection Group) icon, enter a name, and click Create. ; Click on the newly created protection group to open its details. ; In the Members pane, click the menu icon, select Add..., select your production volumes, and click Add. ; In the Snapshot Schedule and Replication Schedule panes, click the Edit (pen and paper) icon.

属性

操作系统: 任意
标签: flasharraystoragedata-protection
参考: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 4.2 Ensure production volumes and hosts are protected by ratcheted (SafeMode) protection groups with daily snapshots