Control: 6.1.1.10 Ensure that Intune logs are captured and sent to Log Analytics
Description
Ensure that Intune logs are captured and fed into a central log analytics workspace.
Intune includes built-in logs that provide information about your environments. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.
Remediation
Remediate from Azure Portal
- Go to
Intune. - Click
Reports. - Under
Azure monitor, clickDiagnostic settings. - Click
+ Add diagnostic setting. - Provide a
Diagnostic setting name. - Under
Logs > Categories, check the box next to each of the following logs:AuditLogsOperationalLogsDeviceComplianceOrgDevicesWindows365AuditLogs
- Under
Destination details, check the box next toSend to Log Analytics workspace. - Select a
Subscription. - Select a
Log Analytics workspace. - Click
Save.
Default Value
By default, Intune diagnostic settings do not exist.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_6_1_1_10Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_6_1_1_10 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;