Prisma Cloud Compute must be configured to send events to the hosts' syslog.
An XCCDF Rule
Description
Event log collection is critical in ensuring the security of a containerized environment due to the ephemeral nature of the workloads. In an environment that is continually in flux, audit logs must be properly collected and secured. Prisma Cloud Compute can be configured to send audit events to the host node's syslog in RFC5424-compliant format. Satisfies: SRG-APP-000111-CTR-000220, SRG-APP-000181-CTR-000485, SRG-APP-000358-CTR-000805, SRG-APP-000474-CTR-001180, SRG-APP-000516-CTR-000790
- ID
- SV-253530r960918_rule
- Version
- CNTR-PC-000310
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Navigate to Prisma Cloud Compute Console's >> Manage >> Alerts >> Logging tab.
Set Syslog to "enabled".
Select the "Manage" tab.