💼 Logging and Monitoring Configuration

• Contextual name: 💼 Logging and Monitoring Configuration
• ID: /frameworks/cloudaware/logging-and-monitoring/logging-and-monitoring-configuration
• Located in: 💼 Logging & Monitoring

Description

Policies for identifying resources that do not capture necessary logging and monitoring information about system activities.

Similar

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags

Policies (59)

Policy	Logic Count	Flags
📝 AWS Account Multi-Region CloudTrail is not enabled 🟢	1	🟢 x6
📝 AWS Account Object-level CloudTrail Logging for Read Events for S3 Buckets is not enabled 🟢	1	🟢 x6
📝 AWS Account Object-level CloudTrail Logging for Write Events for S3 Buckets is not enabled 🟢	1	🟢 x6
📝 AWS API Gateway API Access Logging in CloudWatch is not enabled 🟢	1	🟠 x1, 🟢 x5
📝 AWS API Gateway API Execution Logging in CloudWatch is not enabled 🟢	1	🟢 x6
📝 AWS Athena Workgroup CloudWatch Metrics are not enabled 🟢	1	🟢 x6
📝 AWS CloudFront Distribution Logging is not enabled 🟢	1	🟢 x6
📝 AWS CloudTrail Log File Validation is not enabled 🟢	1	🟢 x6
📝 AWS CloudTrail S3 Bucket Access Logging is not enabled. 🟢	1	🟢 x6
📝 AWS Connect Instance flow logs are not enabled 🟢	1	🟢 x6
📝 AWS Data Sync Task logging is not enabled 🟢	1	🟢 x6
📝 AWS DMS Migration Task Logging is not enabled 🟢	1	🟢 x6
📝 AWS EKS Cluster Logging is not enabled for all control plane logs types 🟢	1	🟢 x6
📝 AWS S3 Bucket Server Access Logging is not enabled 🟢	1	🟢 x6
📝 AWS VPC Flow Logs are not enabled 🟢	1	🟠 x1, 🟢 x5
📝 Azure Diagnostic Setting captures Administrative, Alert, Policy, and Security categories 🟢	1	🟢 x6
📝 Azure Diagnostic Setting exists for Subscription Activity Logs 🟢		🟢 x3
📝 Azure Diagnostic Setting for Azure AppService HTTP logs is not enabled 🟢		🟢 x3
📝 Azure Diagnostic Setting for Azure Key Vault is not enabled 🟢		🟢 x3
📝 Azure Diagnostic Setting is not enabled for all services that support it 🟢		🟢 x3
📝 Azure Diagnostic Setting Logs export to Storage Account not encrypted with Customer-managed key 🟢	1	🟢 x6
📝 Azure MySQL Flexible Server audit_log_enabled Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure MySQL Flexible Server audit_log_events Parameter is not set with the CONNECTION event 🟢	1	🟢 x6
📝 Azure Network Security Group Flow Logs retention period is less than 90 days 🟢	1	🟢 x6
📝 Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days 🟢	1	🟢 x6
📝 Azure PostgreSQL Single Server log_connections Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure SQL Server Auditing is not enabled 🟢	1	🟢 x6
📝 Azure SQL Server Auditing Retention is less than 90 days 🟢	1	🟢 x6
📝 Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests 🟢	1	🟢 x6
📝 Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests 🟢	1	🟢 x6
📝 Azure Storage Table Logging is not enabled for Read, Write, and Delete requests 🟢	1	🟢 x6
📝 Azure Subscription Application Insights are not configured 🟢	1	🟠 x1, 🟢 x5
📝 Azure Subscription Log Analytics Agent is not auto provisioned 🟢	1	🟢 x6
📝 Azure Subscription Network Watcher is not enabled in every available region 🟢	1	🟢 x6
📝 Azure Virtual Network Flow Logs are not captured and sent to Log Analytics Workspace 🟢		🟢 x3
📝 Azure Virtual Network Flow Logs retention period is less than 90 days 🟢	1	🟢 x6
📝 Google Cloud Access Transparency is not enabled 🟢		🟢 x3
📝 Google Cloud Audit Logging is not configured properly 🟢	1	🟢 x6
📝 Google Cloud PostgreSQL Instance Log_statement Database Flag is not set appropriately 🟢	1	🟢 x6
📝 Google GCE Network DNS Policy Logging is not enabled 🟢	1	🟢 x6
📝 Google GCE Subnetwork Flow Logs are not enabled 🟢	1	🟢 x6
📝 Google HTTP(S) Load Balancer Logging is not enabled 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts Cloud Storage IAM Permission Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for Audit Configuration Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for Custom Role Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for Project Ownership Assignments Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for SQL Instance Configuration Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for VPC Network Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for VPC Network Firewall Rule Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Metric Filter and Alerts for VPC Network Route Changes do not exist 🟢	1	🟢 x6
📝 Google Logging Log Sink exports logs to a Storage Bucket without Bucket Lock 🟢	1	🟢 x6
📝 Google Logging Log Sink for All Log Entries is not configured 🟢	1	🟢 x6
📝 Intune logs are not captured and sent to Log Analytics 🟢		🟢 x3
📝 Microsoft Entra ID Diagnostic Setting does not capture Microsoft Entra activity logs 🟢		🟢 x3
📝 Microsoft Entra ID Diagnostic Setting does not capture Microsoft Graph activity logs 🟢		🟢 x3
📝 Network Security Group Flow Logs are not captured and sent to Log Analytics Workspace 🟢		🟢 x3