💼 5.3 Ensure that Diagnostic Logs are enabled for all services which support it. - Level 1 (Manual | Not supported, requires a manual assessment)

• Contextual name: 💼 5.3 Ensure that Diagnostic Logs are enabled for all services which support it. - Level 1 (Manual | Not supported, requires a manual assessment)
• ID: /frameworks/cis-azure-v1.3.0/05/03
• Located in: 💼 5 Logging and Monitoring

Description

Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.

A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.

Note: The CIS Benchmark covers some specific Diagnostic Logs separately. ''' 3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests

6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' ''' The assessment status was updated into "Manual" on the latest version of Azure CIS Benchmark v1.4.0.

Similar

• Internal
  • ID: dec-c-c062af60

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags