Skip to main content

🛡️ Azure Subscription Activity Log Alert for Delete Public IP Address Rule does not exist🟢

  • Contextual name: 🛡️ Activity Log Alert for Delete Public IP Address Rule does not exist🟢
  • ID: /ce/ca/azure/subscription/activity-log-alert-for-delete-public-ip-address-rule
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

Create an activity log alert for the Delete Public IP Address event.

Rationale​

Monitoring for Delete Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Impact​

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Audit​

This policy flags an Azure Subscription as INCOMPLIANT if it does not have an enabled related Azure Activity Log Alert scoped to the subscription whose Condition JSON filters on the Administrative category and the Microsoft.Network/publicIPAddresses/delete operation.

Default Value​

By default, no monitoring alerts are created or active.

References​

  1. https://azure.microsoft.com/en-us/updates?id=classic-alerting-monitoring-retirement
  2. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule
  3. https://learn.microsoft.com/en-us/rest/api/monitor/activity-log-alerts/create-or-update

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Navigate to the Monitor blade.
  2. Select Alerts.
  3. Select Create.
  4. Select Alert rule.
  5. Choose a subscription.
  6. Select Apply.
  7. Select the Condition tab.
  8. Click See all signals.
  9. Select Delete Public Ip Address (Public Ip Address).
  10. Click Apply.
  11. Select the Actions tab.
  12. Click Select action groups to select an existing action group, or Create action group to create a new action group.
  13. Follow the prompts to choose or create an action group.
  14. Select the Details tab.
  15. Select a Resource group, provide an Alert rule name and an optional Alert rule description.
  16. Click Review + create.
  17. Click Create.

From Azure CLI​

az monitor activity-log alert create \
    --resource-group {{resource-group-name}} \
    --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete and level={{verbose | information | warning | error | critical}} \
    --scope /subscriptions/{{subscription-id}} \
    --name {{activity-log-rule-name}} \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v5.0.0 → 💼 6.1.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 6.1.2.10 Ensure that Activity Log Alert Exists for Delete Public IP Address rule (Automated)1no data
💼 Cloudaware Framework → 💼 Alerting and Notification42no data