Ensure SMB audit policies with syslog and file log targets are attached to production file systems

中等級 1人工審核flasharray

說明

FlashArray supports creation of one or more audit policies for enabling audit of operations over the SMB data protocol. These audit policies may be used to send audit records to remote syslog servers for monitoring. Everpure recommends the following: ; Configure at least 1 syslog server and 1 directory as log targets among your audit policies for SMB. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Run the commands purelog file list and purelog syslog list to verify that local and remote log targets exist. ; Run the command purepolicy audit file list to verify that an audit policy exists and its Enabled status is set to True. ; Review the policy members by running purepolicy audit file list --member to ensure the policies are successfully attached to the correct source managed directories.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, establish file log targets, create an audit policy, attach it to your production managed directories, and externally configure SACLs for SMB exports. From the GUI: ; Create the File Log Target: Navigate to Settings > System. In the File Log Targets panel, click the + (Create) icon. Provide a name, select an empty managed directory to store the logs, configure a retention policy (Keep For or Keep Size), and click Create. ; Create the Syslog Target (if not already configured): In the Syslog Servers panel, add your remote syslog server URI. ; Create the Audit Policy: Navigate to Storage > Policies.

屬性

作業系統: 不限
標籤: flasharraystoragefile-services
參考資料: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 3.6 Ensure SMB audit policies with syslog and file log targets are attached to production file systems