📝 Azure Subscription Activity Log Alert for Delete SQL Server Firewall Rule does not exist 🟢

• Contextual name: 📝 Activity Log Alert for Delete SQL Server Firewall Rule does not exist 🟢
• ID: /ce/ca/azure/subscription/activity-log-alert-for-delete-sql-server-firewall-rule
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Create Alert for 'Create, Update or Delete SQL Server Firewall Rule' Events
• Internal
  • dec-x-6fc9c949

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-6fc9c949	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Subscription
  • 🔌 Azure Activity Log Alert - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Create an activity log alert for the "Delete SQL Server Firewall Rule."

Rationale

Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.

Impact

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Audit

From Azure Portal

1. Navigate to the Monitor blade.
2. Click on Alerts.
3. In the Alerts window, click on Alert rules.
4. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Sql/servers/firewallRules/delete.
5. Click on the Alert Name associated with the previous step.
6. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete server firewall rule' and does not filter on Level, Status or Caller.
7. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Navigate to the Monitor blade.
2. Select Alerts.
3. Select Create.
4. Select Alert rule.
5. Choose a subscription.
6. Select Apply.
7. Select the Condition tab.
8. Click See all signals.
9. Select Delete server firewall rule (Server Firewall Rule).
10. Click Apply.
11. Select the Actions tab.
12. Click Select action groups to select an existing action group, or Create action group to create a new action group.
13. Follow the prompts to choose or create an action group.
14. Select the Details tab.
15. Select a Resource group, provide an Alert rule name and an optional Alert rule description.
16. Click Review + create.
17. Click Create.

From Azure CLI

az monitor activity-log alert create --resource-group "<resource group name>" --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level=<verbose | information | warning | error | critical> --scope "/subscriptions/<subscription ID>" --name "<activity log rule name>" --subscription <subscription id> --action-group <action group ID>

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 36a change management —information security is addressed as part of the change management process and the information asset inventory is updated;		7	8
💼 APRA CPG 234 → 💼 44b deletion or corruption of both production and backup data, either through malicious intent, user error or system malfunction;		6	7
💼 APRA CPG 234 → 💼 67b scanning for unauthorised hardware, software and changes to configurations;		7	8
💼 CIS Azure v1.5.0 → 💼 5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule - Level 1 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule - Level 1 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 6.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (Automated)			1
💼 Cloudaware Framework → 💼 Alerting and Notification			25
💼 FedRAMP High Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)			14
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)			14
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence		14	15
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging		19	20
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST SP 800-53 Revision 5 → 💼 AU-3(1) Content of Audit Records _ Additional Audit Information		13	14
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47