Skip to main content

💼 Logging and Monitoring Configuration

  • ID: /frameworks/cloudaware/logging-and-monitoring/logging-and-monitoring-configuration

Description​

Policies for identifying resources that do not capture necessary logging and monitoring information about system activities.

Similar​

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (65)​

PolicyLogic CountFlagsCompliance
🛡️ AWS Account Multi-Region CloudTrail is not enabled🟢1🟢 x6no data
🛡️ AWS Account Object-level CloudTrail Logging for Read Events for S3 Buckets is not enabled🟢1🟢 x6no data
🛡️ AWS Account Object-level CloudTrail Logging for Write Events for S3 Buckets is not enabled🟢1🟢 x6no data
🛡️ AWS API Gateway API Access Logging in CloudWatch is not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ AWS API Gateway API Execution Logging in CloudWatch is not enabled🟢1🟢 x6no data
🛡️ AWS Athena Workgroup CloudWatch Metrics are not enabled🟢1🟢 x6no data
🛡️ AWS CloudFront Distribution Logging is not enabled🟢1🟢 x6no data
🛡️ AWS CloudTrail Log File Validation is not enabled🟢1🟢 x6no data
🛡️ AWS CloudTrail S3 Bucket Access Logging is not enabled.🟢1🟢 x6no data
🛡️ AWS Connect Instance flow logs are not enabled🟢1🟢 x6no data
🛡️ AWS Data Sync Task logging is not enabled🟢1🟢 x6no data
🛡️ AWS DMS Migration Task Logging is not enabled🟢1🟢 x6no data
🛡️ AWS EKS Cluster Logging is not enabled for all control plane logs types🟢1🟢 x6no data
🛡️ AWS GuardDuty Detector EKS Audit Log Monitoring is not enabled🟢1🟢 x6no data
🛡️ AWS S3 Bucket Server Access Logging is not enabled🟢1🟢 x6no data
🛡️ AWS VPC Flow Logs are not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ Azure Diagnostic Setting captures Administrative, Alert, Policy, and Security categories🟢1🟢 x6no data
🛡️ Azure Diagnostic Setting exists for Subscription Activity Logs🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Diagnostic Setting for Azure AppService HTTP logs is not enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Diagnostic Setting for Azure Key Vault is not enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Diagnostic Setting is not enabled for all services that support it🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Diagnostic Setting Logs export to Storage Account not encrypted with Customer-managed key🟢1🟢 x6no data
🛡️ Azure MySQL Flexible Server audit_log_enabled Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure MySQL Flexible Server audit_log_events Parameter is not set with the CONNECTION event🟢1🟢 x6no data
🛡️ Azure Network Security Group Flow Logs retention period is less than 90 days🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_connections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing is not enabled🟢1🟢 x6no data
🛡️ Azure SQL Server Auditing Retention is less than 90 days🟢1🟢 x6no data
🛡️ Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Storage Table Logging is not enabled for Read, Write, and Delete requests🟢1🟢 x6no data
🛡️ Azure Subscription Application Insights are not configured🟢1🟠 x1, 🟢 x5no data
🛡️ Azure Subscription Log Analytics Agent is not auto provisioned🟢1🟢 x6no data
🛡️ Azure Subscription Network Watcher is not enabled in every available region🟢1🟢 x6no data
🛡️ Azure Virtual Network Flow Logs are not captured and sent to Log Analytics Workspace🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Virtual Network Flow Logs retention period is less than 90 days🟢1🟢 x6no data
🛡️ Google Cloud Access Transparency is not enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Google Cloud Audit Logging is not configured properly🟢1🟢 x6no data
🛡️ Google Cloud PostgreSQL Instance Log_statement Database Flag is not set appropriately🟢1🟢 x6no data
🛡️ Google GCE Firewall Rule logging is disabled🟢1🟢 x6no data
🛡️ Google GCE Network DNS Policy Logging is not enabled🟢1🟢 x6no data
🛡️ Google GCE Subnetwork Flow Logs are not enabled🟢1🟢 x6no data
🛡️ Google GKE Cluster Logging is not enabled🟢1🟢 x6no data
🛡️ Google GKE Cluster Monitoring is not enabled🟢1🟢 x6no data
🛡️ Google HTTP(S) Load Balancer Logging is not enabled🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts Cloud Storage IAM Permission Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for Audit Configuration Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for Custom Role Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for Project Ownership Assignments Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for SQL Instance Configuration Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for VPC Network Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for VPC Network Firewall Rule Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Metric Filter and Alerts for VPC Network Route Changes do not exist🟢1🟢 x6no data
🛡️ Google Logging Log Sink exports logs to a Storage Bucket without Bucket Lock🟢1🟢 x6no data
🛡️ Google Logging Log Sink for All Log Entries is not configured🟢1🟢 x6no data
🛡️ Google Storage Bucket logging is not enabled🟢1🟠 x1, 🟢 x5no data
🛡️ Google Storage Bucket with Log Sink does not have Versioning🟢1🟢 x6no data
🛡️ Intune logs are not captured and sent to Log Analytics🟢⚪🟢 x2, ⚪ x1no data
🛡️ Microsoft Entra ID Diagnostic Setting does not capture Microsoft Entra activity logs🟢⚪🟢 x2, ⚪ x1no data
🛡️ Microsoft Entra ID Diagnostic Setting does not capture Microsoft Graph activity logs🟢⚪🟢 x2, ⚪ x1no data
🛡️ Network Security Group Flow Logs are not captured and sent to Log Analytics Workspace🟢⚪🟢 x2, ⚪ x1no data