📝 Azure Subscription Activity Log Alert for Create or Update Public IP Address Rule does not exist 🟢

• Contextual name: 📝 Activity Log Alert for Create or Update Public IP Address Rule does not exist 🟢
• ID: /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-public-ip-address-rule
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Create Alert for 'Create or Update Public IP Address' Events

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Subscription
  • 🔌 Azure Activity Log Alert - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Create an activity log alert for the Create or Update Public IP Addresses rule.

Rationale

Monitoring for Create or Update Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Impact

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Audit

From Azure Portal

1. Navigate to the Monitor blade.
2. Click on Alerts.
3. In the Alerts window, click on Alert rules.
4. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Network/publicIPAddresses/write.
5. Click on the Alert Name associated with the previous step.
6. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Public Ip Address' and does not filter on Level, Status or Caller.
7. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Navigate to the Monitor blade.
2. Select Alerts.
3. Select Create.
4. Select Alert rule.
5. Choose a subscription.
6. Select Apply.
7. Select the Condition tab.
8. Click See all signals.
9. Select Create or Update Public Ip Address (Public Ip Address).
10. Click Apply.
11. Select the Actions tab.
12. Click Select action groups to select an existing action group, or Create action group to create a new action group.
13. Follow the prompts to choose or create an action group.
14. Select the Details tab.
15. Select a Resource group, provide an Alert rule name and an optional Alert rule description.
16. Click Review + create.
17. Click Create.

From Azure CLI

az monitor activity-log alert create --resource-group "<resource group name>" --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=<verbose | information | warning | error | critical> --scope "/subscriptions/<subscription ID>" --name "<activity log rule name>" --subscription <subscription id> --action-group <action group ID>

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v2.1.0 → 💼 5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule - Level 1 (Automated)			1
💼 CIS Azure v3.0.0 → 💼 6.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (Automated)			1
💼 Cloudaware Framework → 💼 Alerting and Notification			25