Benchmark: 5.1 Configuring Diagnostic Settings
Overview
The Azure Diagnostic Settings capture control/management activities performed on a subscription. By default, the Azure Portal retains activity logs only for 90 days. The Diagnostic Settings define the type of events that are stored or streamed and the outputs - storage account and/or event hub. The Diagnostic Settings, if configured properly, can ensure that all activity logs are retained for longer duration. This section has recommendations for correctly configuring the Diagnostic Settings so that all activity logs captured are retained for longer periods.
When configuring Diagnostic Settings you may choose to export in one of three ways in which you need to ensure appropriate data retention. The options are Log Analytics, Event Hub, and a Storage Account. It is important to ensure you are aware and have set retention as your organization sees fit.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 5.1 Configuring Diagnostic Settings.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v140_5_1Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v140_5_1 --shareControls
- 5.1.1 Ensure that a 'Diagnostics Setting' exists
- 5.1.2 Ensure Diagnostic Setting captures appropriate categories
- 5.1.3 Ensure the storage container storing the activity logs is not publicly accessible
- 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key)
- 5.1.5 Ensure that logging for Azure KeyVault is 'Enabled'