Skip to main content

🛡️ Azure Diagnostic Setting captures Administrative, Alert, Policy, and Security categories🟢

  • Contextual name: 🛡️ Diagnostic Setting captures Administrative, Alert, Policy, and Security categories🟢
  • ID: /ce/ca/azure/monitor/diagnostic-setting-categories
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY, RELIABILITY

Logic​

Similar Policies​

  • Internal: dec-x-a193b20f

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-a193b20f1

Description​

Open File

Description​

Prerequisite: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: "Ensure that a 'Diagnostic Setting' exists."

The diagnostic setting should be configured to log the appropriate activities from the control/management plane.

Rationale​

A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.

Audit​

This policy flags an Azure Subscription Diagnostic Setting as INCOMPLIANT if the Logs JSON does not capture one of the following categories: Administrative, Alert, Policy, Security.

Default Value​

When the diagnostic setting is created using Azure Portal, by default no categories are selected.

References​

  1. https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Azure Monitor.
  2. Click Activity log.
  3. Click on Export Activity Logs.
  4. Select the Subscription from the drop down menu.
  5. Click Edit setting next to a diagnostic setting.
  6. Check the following categories: Administrative, Alert, Policy, and Security.
  7. Choose the destination details according to your organization's needs.
  8. Click Save.

From Azure CLI​

az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> --event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID> --storage-account <storage account ID> --workspace <log analytics workspace ID> --logs "[{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}]"

From PowerShell​

$logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 8 For accountability purposes, a regulated entity would typically ensure that users and information assets are uniquely identified and their actions are logged at a sufficient level of granularity to support information security monitoring processes.22no data
💼 APRA CPG 234 → 💼 16b situational awareness and intelligence;67no data
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;911no data
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;911no data
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 APRA CPG 234 → 💼 e. use of, and access to, information assets is attributable to an individual, hardware or software, and activity logged and monitored;22no data
💼 CIS Azure v1.3.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)11no data
💼 CIS Azure v1.4.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 5.1.2 Ensure Diagnostic Setting captures appropriate categories - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 6.1.2 Ensure Diagnostic Setting captures appropriate categories (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 7.1.1.2 Ensure Diagnostic Setting captures appropriate categories (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration65no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)16no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)726no data
💼 FedRAMP High Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)14no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)265no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)425no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4851no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)16no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)14no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)219no data
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence1421no data
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging1834no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events85no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events142no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked31no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions1416no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1719no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3(1) Content of Audit Records _ Additional Audit Information1314no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44765no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81725no data