Ensure default protection is configured at the array level and for every pod

中等級 1人工審核flasharray

說明

FlashArray allows the array and its pods to have default protection configured. This allows you to configure pgroups that will be automatically associated with any volumes created within the pod or the array. This can be used to ensure that all block data has some level of data protection by default. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Run the command purearray default-protection list to view the default protection group lists for the array root (denoted by - in the Container Name column) and all pods. ; Run the command purepgroup list --retention-lock to verify that the SafeMode status is ratcheted and manual eradication is disabled for the protection groups assigned as defaults.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, assign a ratcheted protection group to the array root and all pods so that newly provisioned data receives baseline SafeMode protection automatically. From the GUI: ; Navigate to Protection > Array. ; In the Default Protection panel, click the Edit (Set Default Protection) icon on the right of the appropriate row (the - row for the root of the array, or the row for a specific pod). ; In the Available Protection Groups column, select the protection groups to be added so they appear in the Selected Protection Groups column. ; Click Set. ; Navigate to Protection > Protection Groups and select your assigned default protection group.

屬性

作業系統: 不限
標籤: flasharraystoragedata-protection
參考資料: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 4.4 Ensure default protection is configured at the array level and for every pod