Benchmark: 7.1.2 Monitoring using Activity Log Alerts
Overview
The recommendations provided in this section are intended to provide entry-level alerting for crucial activities on a tenant account. These recommended activities should be tuned to your needs. By default, each of these Activity Log Alerts tends to guide the reader to alerting at the "Subscription-wide" level which will capture and alert on rules triggered by all resources and resource groups contained within a subscription. This is not an ideal rule set for Alerting within larger and more complex organizations.
While this section provides recommendations for the creation of Activity Log Alerts specifically, Microsoft Azure supports four different types of alerts:
- Metric Alerts
- Log Alerts
- Activity Log Alerts
- Smart Detection Alerts
All Azure services (Microsoft provided or otherwise) that can generate alerts are assigned a "Resource provider namespace" when they are registered in an Azure tenant. The recommendations in this section are in no way exhaustive of the plethora of available "Providers" or "Resource Types." The Resource Providers that are registered in your Azure Tenant can be located in your Subscription. Each registered Provider in your environment may have available "Conditions" to raise alerts via Activity Log Alerts. These providers should be considered for inclusion in Activity Log Alert rules of your own making.
To view the registered resource providers in your Subscription(s), use this guide:
If you wish to create custom alerting rules for Activity Log Alerts or other alert types, please refer to Microsoft documentation:
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 7.1.2 Monitoring using Activity Log Alerts.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v400_7_1_2Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v400_7_1_2 --shareControls
- 7.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment
- 7.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 7.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 7.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
- 7.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 7.1.2.6 Ensure that Activity Log Alert exists for Delete Security Solution
- 7.1.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule
- 7.1.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule
- 7.1.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule
- 7.1.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule
- 7.1.2.11 Ensure that an Activity Log Alert exists for Service Health