📝 Azure Diagnostic Setting captures Administrative, Alert, Policy, and Security categories 🟢

• Contextual name: 📝 Diagnostic Setting captures Administrative, Alert, Policy, and Security categories 🟢
• ID: /ce/ca/azure/monitor/diagnostic-setting-categories
• Located in: 📁 Azure Monitor

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY
  • RELIABILITY

Similar Policies

• Internal
  • dec-x-a193b20f

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-a193b20f	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Diagnostic Setting
  • 🔌 Azure Diagnostic Setting - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Prerequisite: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: "Ensure that a 'Diagnostic Setting' exists."

The diagnostic setting should be configured to log the appropriate activities from the control/management plane.

Rationale

A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.

Audit

This policy flags an Azure Subscription Diagnostic Setting as INCOMPLIANT if the Logs JSON does not capture one of the following categories: Administrative, Alert, Policy, Security.

Default Value

When the diagnostic setting is created using Azure Portal, by default no categories are selected.

References

1. https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Azure Monitor.
2. Click Activity log.
3. Click on Export Activity Logs.
4. Select the Subscription from the drop down menu.
5. Click Edit setting next to a diagnostic setting.
6. Check the following categories: Administrative, Alert, Policy, and Security.
7. Choose the destination details according to your organization's needs.
8. Click Save.

From Azure CLI

az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> --event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID> --storage-account <storage account ID> --workspace <log analytics workspace ID> --logs "[{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}]"

From PowerShell

$logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 8 For accountability purposes, a regulated entity would typically ensure that users and information assets are uniquely identified and their actions are logged at a sufficient level of granularity to support information security monitoring processes.		2	2
💼 APRA CPG 234 → 💼 16b situational awareness and intelligence;		6	7
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;		9	11
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;		9	11
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		19	22
💼 APRA CPG 234 → 💼 e. use of, and access to, information assets is attributable to an individual, hardware or software, and activity logged and monitored;		2	2
💼 CIS Azure v1.3.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 6.1.2 Ensure Diagnostic Setting captures appropriate categories (Automated)			1
💼 CIS Azure v4.0.0 → 💼 7.1.1.2 Ensure Diagnostic Setting captures appropriate categories (Automated)			1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			59
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			16
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)		7	26
💼 FedRAMP High Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)			14
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		65
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	4		25
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		48	51
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)			26
💼 FedRAMP Moderate Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)			14
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	2		19
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence		14	21
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging		18	34
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			115
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			81
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			134
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			28
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions		14	16
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions		17	19
💼 NIST SP 800-53 Revision 5 → 💼 AU-3(1) Content of Audit Records _ Additional Audit Information		13	14
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	47	65
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control	8	17	25