Enabling security observability
To detect and prevent threats, organizations need to promptly spot malicious insiders, compromised accounts, malware infections, and other problems. With NetBackup and NetBackup appliances, you can forward logs to an external log management server or a security information and event management (SIEM) solution. The logs include elevated shell commands for the appliances and have consistent timestamp formats, which are necessary for accurate and efficient event correlations and log analysis.
SIEM, SOAR, and XDR platforms are tools to combat unwanted trends and unsanctioned actions in IT ecosystems. NetBackup audit messages can be custom filtered and consumed by SIEM platforms, which scan the system log of the primary server and digest that information to provide reports, insights, and alerts. Automated response integration within NetBackup can automatically pause clients to stop any spread of undesired data, and SOAR integrations allow further customized actions based on scenarios in the various message categories. NetBackup adds more capability to your ransomware response plans with the insight and control of audit messaging.
How to enable log forwarding:
Flex Appliance
See Forwarding logs.
NetBackup Appliance
NetBackup
Access Appliance
Flex Appliance also includes a security meter to view and configure the security settings from one location. The security meter tracks the security settings and shows you a list of the available features with quick links to configure them. It is accessible from the Flex Appliance Console home page by a security administrator.
Figure: Security meter shows how the security meter works, or you can see it in action in the security meter demo.
The Access Appliance includes a security meter to view and configure the appliance security settings from one location. The security meter provides security insights and recommendations to improve the appliance security. The security meter keeps a track of the security settings and shows you a list of available security features with quick links to configure them. The security meter displays the current security index from good to excellent based on how many security features are turned on. Built-in security features are turned on and shown as Enabled in the security meter.
The security meter can be found on the appliance dashboard. Only an administrator user can view and manage the settings from the security meter. The following figure shows the security meter that is shown the appliance dashboard:
The following figure shows the available security settings that you can track and manage:
