📝 Azure Subscription Activity Log Alert for Create or Update Network Security Group does not exist 🟢
- Contextual name: 📝 Activity Log Alert for Create or Update Network Security Group does not exist 🟢
- ID:
/ce/ca/azure/subscription/activity-log-alert-for-create-or-update-nsg - Located in: 📁 Azure Subscription
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-x-79579ed7
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-79579ed7 | 1 |
Logic
- 🧠 prod.logic.yaml 🟢
Description
Description
Create an Activity Log Alert for the Create or Update Network Security Group event.
Rationale
Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
Audit
From Azure Portal
- Navigate to the
Monitorblade.- Click on
Alerts.- In the Alerts window, click on
Alert rules.- Ensure an alert rule exists where the Condition column contains
Operation name=Microsoft.Network/networkSecurityGroups/write.- Click on the Alert Name associated with the previous step.
- Ensure the
Conditionpanel displays the textWhenever the Activity Log has an event with Category='Administrative',Operation name='Create or Update Network Security Group'and does not filter onLevel,StatusorCaller.- Ensure the
Actionspanel displays an Action group is assigned to notify the appropriate personnel in your organization.From Azure CLI
az monitor activity-log alert list --subscription <subscription ID> --query "[].{Name:name,Enabled:enabled,check:condition.allOf,Actions:actions}"
... [see more](description.md)
Remediation
Remediation
From Azure Portal
- Navigate to the
Monitorblade.- Select
Alerts.- Select
Create.- Select
Alert rule.- Choose a subscription.
- Select
Apply.- Select the
Conditiontab.- Click
See all signals.- Select
Create or Update Network Security Group (Network Security Group).- Click
Apply.- Select the
Actionstab.- Click
Select action groupsto select an existing action group, orCreate action groupto create a new action group.- Follow the prompts to choose or create an action group.
- Select the
Detailstab.- Select a
Resource group, provide anAlert rule nameand an optionalAlert rule description.- Click
Review + create.- Click
Create.From Azure CLI
az monitor activity-log alert create --resource-group "<resource group name>" --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope "/subscriptions/<subscription ID>" --name "<activity log rule name>" --subscription <subscription id> --action-group <action group ID>
... [see more](remediation.md)