Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API

中等級 1人工審核flasharray

說明

FlashArray creates administrative audit records for all administrative operations that cause a change to the system configuration or state. Everpure recommends that these logs be monitored via REST API, or sent to configured remote syslog servers in order to detect suspicious or unexpected activity and respond accordingly. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Verify Syslog Forwarding: Run the command purelog syslog list. Review the output to confirm a remote syslog server URI is configured. ; Verify Audit Records: Run the command pureaudit list (or pureaudit list -- filter "time >= '<YYYY-MM-DD>'" for recent events). Review the output to ensure the Time, User, Command, and Arguments are being accurately recorded. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an active external script or tool is successfully authenticating and pulling the audit logs via the FlashArray REST API.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration, and establish a process to review unexpected configurations. From the GUI: ; To Configure Syslog Forwarding: ; Navigate to Settings > System. ; In the Syslog Servers panel, click the + (Create) icon. ; Enter the URI of your remote syslog server (e.g., tcp://10.10.10.10:514) and click Create. ; To Configure REST API Monitoring: ; Integrate your SIEM or monitoring tool using the Pure Storage REST API endpoints to continuously poll for audit trail events.

屬性

作業系統: 不限
標籤: flasharraystorageaccess-control
參考資料: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.10 Ensure administrative audit logs are forwarded to remote syslog or monitored via the REST API