Control: Ensure that Activity Log Alert exists for Delete Security Solution
Description
Create an activity log alert for the Delete Security Solution event.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.monitor_log_alert_delete_security_solution
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.monitor_log_alert_delete_security_solution --share
SQL
This control uses a named query:
with alert_rule as ( select alert.id as alert_id, alert.name as alert_name, alert.enabled, alert.location, alert.subscription_id from azure_log_alert as alert, jsonb_array_elements_text(scopes) as sc where alert.location = 'global' and alert.enabled and sc = '/subscriptions/' || alert.subscription_id and ( ( alert.condition -> 'allOf' @> '[{"equals":"Security","field":"category"}]' and alert.condition -> 'allOf' @> '[{"field": "operationName", "equals": "Microsoft.Security/securitySolutions/delete"}]' ) or ( alert.condition -> 'allOf' @> '[{"equals":"Security","field":"category"}]' and alert.condition -> 'allOf' @> '[{"field": "resourceType", "equals": "microsoft.security/securitysolutions"}]' and jsonb_array_length(alert.condition -> 'allOf') = 2 ) ) limit 1)select sub.subscription_id as resource, case when count(a.subscription_id) > 0 then 'ok' else 'alarm' end as status, case when count(a.subscription_id) > 0 then 'Activity log alert exists for delete Security Solution event.' else 'Activity log alert does not exists for delete Security Solution event.' end as reason , sub.display_name as subscriptionfrom azure_subscription sub left join alert_rule a on sub.subscription_id = a.subscription_idgroup by sub._ctx, sub.subscription_id, sub.display_name;