Control: 5.1.2 Ensure Diagnostic Setting captures appropriate categories
Description
The diagnostic setting should be configured to log the appropriate activities from the control/management plane.
A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.
Remediation
From Console
- Login to
Azure Monitor console - Click Activity log
- Click on Diagnostic settings
- Click on
AddorEditSettings for the diagnostic settings entry - Ensure that the following categories are checked:
Administrative,Alert,Policy, andSecurity
Note: By default, diagnostic setting is not set.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v140_5_1_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v140_5_1_2 --shareSQL
This control uses a named query:
monitor_diagnostic_settings_captures_proper_categories