Skip to main content

💼 5.2 Monitoring using Activity Log Alerts

  • Contextual name: 💼 5.2 Monitoring using Activity Log Alerts
  • ID: /frameworks/cis-azure-v2.1.0/05/02
  • Located in: 💼 5 Logging and Monitoring

Description​

The recommendations provided in this section are intended to provide entry-level alerting for crucial activities on a tenant account. These recommended activities should be tuned to your needs. By default, each of these Activity Log Alerts tends to guide the reader to alerting at the "Subscription-wide" level which will capture and alert on rules triggered by all resources and resource groups contained within a subscription. This is not an ideal rule set for Alerting within larger and more complex organizations.

While this section provides recommendations for the creation of Activity Log Alerts specifically, Microsoft Azure supports four different types of alerts:

  • Metric Alerts
  • Log Alerts
  • Activity Log Alerts
  • Smart Detection Alerts

All Azure services (Microsoft provided or otherwise) that can generate alerts are assigned a "Resource provider namespace" when they are registered in an Azure tenant. The recommendations in this section are in no way exhaustive of the plethora of available "Providers" or "Resource Types." The Resource Providers that are registered in your Azure Tenant can be located in your Subscription. Each registered Provider in your environment may have available "Conditions" to raise alerts via Activity Log Alerts. These providers should be considered for inclusion in Activity Log Alert rules of your own making.

To view the registered resource providers in your Subscription(s), use this guide:

If you wish to create custom alerting rules for Activity Log Alerts or other alert types, please refer to Microsoft documentation:

Similar​

  • Internal
    • ID: dec-b-e06588c1

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment - Level 1 (Automated)11
💼 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment - Level 1 (Automated)11
💼 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group - Level 1 (Automated)11
💼 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group - Level 1 (Automated)11
💼 5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution - Level 1 (Automated)1
💼 5.2.6 Ensure that Activity Log Alert exists for Delete Security Solution - Level 1 (Automated)11
💼 5.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule - Level 1 (Automated)11
💼 5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule - Level 1 (Automated)11
💼 5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule - Level 1 (Automated)1
💼 5.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule - Level 1 (Automated)1