Skip to main content

🛡️ Azure Subscription Activity Log Alert for Create Policy Assignment does not exist🟢

  • Contextual name: 🛡️ Activity Log Alert for Create Policy Assignment does not exist🟢
  • ID: /ce/ca/azure/subscription/activity-log-alert-for-create-policy-assignment
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-dc359e591

Description​

Open File

Description​

Create an activity log alert for the Create Policy Assignment event.

Rationale​

Monitoring for create policy assignment events gives insight into changes done in "Azure policy - assignments" and can reduce the time it takes to detect unsolicited changes.

Audit​

This policy flags an Azure Subscription as INCOMPLIANT if it does not have an enabled related Azure Activity Log Alert scoped to the subscription whose Condition JSON filters on the Administrative category and the Microsoft.Authorization/policyAssignments/write operation.

Default Value​

By default, no monitoring alerts are created.

References​

  1. https://azure.microsoft.com/en-us/updates?id=classic-alerting-monitoring-retirement
  2. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule
  3. https://learn.microsoft.com/en-us/rest/api/monitor/activity-log-alerts/create-or-update
  4. https://learn.microsoft.com/en-us/rest/api/monitor/activity-log-alerts/list-by-subscription-id
  5. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Navigate to the Monitor blade.
  2. Select Alerts.
  3. Select Create.
  4. Select Alert rule.
  5. Choose a subscription.
  6. Select Apply.
  7. Select the Condition tab.
  8. Click See all signals.
  9. Select Create policy assignment (Policy assignment).
  10. Click Apply.
  11. Select the Actions tab.
  12. Click Select action groups to select an existing action group, or Create action group to create a new action group.
  13. Follow the prompts to choose or create an action group.
  14. Select the Details tab.
  15. Select a Resource group, provide an Alert rule name and an optional Alert rule description.
  16. Click Review + create.
  17. Click Create.

From Azure CLI​

az monitor activity-log alert create \
    --resource-group {{resource-group-name}} \
    --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write and level={{verbose | information | warning | error | critical}} \
    --scope /subscriptions/{{subscription-id}} \
    --name {{activity-log-rule-name}} \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16b situational awareness and intelligence;77no data
💼 APRA CPG 234 → 💼 36a change management —information security is addressed as part of the change management process and the information asset inventory is updated;88no data
💼 APRA CPG 234 → 💼 67b scanning for unauthorised hardware, software and changes to configurations;88no data
💼 CIS Azure v1.1.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment11no data
💼 CIS Azure v1.3.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11no data
💼 CIS Azure v1.4.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 6.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 7.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (Automated)1no data
💼 CIS Azure v5.0.0 → 💼 6.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 6.1.2.1 Ensure that Activity Log Alert Exists for Create Policy Assignment (Automated)1no data
💼 Cloudaware Framework → 💼 Alerting and Notification42no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)124no data
💼 FedRAMP High Security Controls → 💼 AC-2(7) Privileged User Accounts (M)(H)67no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)834no data
💼 FedRAMP High Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)15no data
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62344no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)31013no data
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)1920no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)276no data
💼 FedRAMP High Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)99no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)5159no data
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)26no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)12no data
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)20no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(7) Privileged User Accounts (M)(H)7no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)15no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)244no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)112no data
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)20no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)9no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging1820no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.3 Administrator and operator logs99no data
💼 ISO/IEC 27001:2013 → 💼 A.16.1.2 Reporting information security events1010no data
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence1622no data
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging2035no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods2126no data
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors2140no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events2165no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2328no data
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed2126no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated3235no data
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations1821no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1935no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated2126no data
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria2224no data
💼 NIST CSF v1.1 → 💼 RS.CO-3: Information is shared consistent with response plans1718no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities53no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources68no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools35no data
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis40no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events187no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events107no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events53no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship28no data
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition28no data
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging24no data
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents33no data
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders19no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated27no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions1523no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3(1) Content of Audit Records _ Additional Audit Information1515no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation45076no data
💼 SOC 2 → 💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1737no data