Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API

中等級 1人工審核flasharray

說明

FlashArray creates administrative session records for all administrative logins and logouts, whether successful or unsuccessful. Everpure recommends that these logs be monitored via REST API, or sent to configured remote syslog servers in order to detect suspicious or unexpected activity and respond accordingly. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Verify Session Records: Run the command puresession list to display user session logs. Review the output to ensure Start Time, End Time, Interface, User, Location, and Event fields are being actively recorded. ; Verify Syslog Forwarding: Run the command purelog syslog list to confirm a remote syslog server URI is configured. ; Verify REST API (If Syslog is not used): Verify with your monitoring teams that an external script is successfully polling the FlashArray REST API for session records.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, implement continuous monitoring by configuring external syslog forwarding or REST API integration for session logs, and establish a process to review logs for weak authentication methods or unexpected access. From the GUI: ; Establish a Review Process: Create a standard operating procedure to regularly review the Session Log pane under Settings > Access specifically looking for unexpected IP locations or failed authentication events. ; To Configure Syslog Forwarding: Navigate to Settings > System. In the Syslog Servers panel, click the + (Create) icon, enter your remote syslog server URI, and click Create.

屬性

作業系統: 不限
標籤: flasharraystorageaccess-control
參考資料: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.11 Ensure administrative session logs are forwarded to remote syslog or monitored via the REST API