Skip to main content

🛡️ Azure Diagnostic Setting is not enabled for all services that support it🟢⚪

  • Contextual name: 🛡️ Diagnostic Setting is not enabled for all services that support it🟢⚪
  • ID: /ce/ca/azure/monitor/diagnostic-setting-for-all-services
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY, RELIABILITY

Similar Policies​

Description​

Open File

Description​

Resource Logs capture activity in the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations performed within a resource itself, for example, reading or updating a secret in Key Vault. Currently, 95 Azure resources support Azure Monitor (see the References section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.

In many environments, back-end services are not configured to log and store Resource Logs for certain activities or for a sufficient length of time. It is crucial that monitoring is configured to log all relevant activities and retain those logs for an appropriate duration. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.

While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Determining whether resource logging should be enabled for specific resources depends on the context and requirements of each organization and environment.

... see more

Remediation​

Open File

Remediation​

Azure Subscriptions should log every access and operation for all resources. Logs should be sent to Storage and a Log Analytics Workspace or an equivalent third-party system. Logs should be kept in readily accessible storage for a minimum of one year, and then moved to inexpensive cold storage for as long as necessary. If retention policies are set but storing logs in a Storage Account is disabled, for example, if only Event Hubs or Log Analytics options are selected, the retention policies have no effect. Enable all monitoring at first, then move data to cold storage more aggressively if the volume becomes a cost concern.

From Azure Portal​

The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:

  1. Go to the resource.
  2. Click on Diagnostic settings.
  3. In the blade that appears, click Add diagnostic setting.
  4. Configure the diagnostic settings.
  5. Click on Save.

From Azure CLI​

For each resource, run the following making sure to use a resource appropriate JSON encoded category for the --logs option:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v5.0.0 → 💼 6.1.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it (Manual)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration75no data