Cis Azure Foundations 6.1.1.2

Ensure Diagnostic Setting captures appropriate categories

Description

Prerequisite: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available.

The diagnostic setting should be configured to log the appropriate activities from the control/management plane.

Rationale

A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.

Impact

None identified.

Audit Procedure

Using Azure Portal

1. Go to Monitor.
2. Click Activity log.
3. Click on Export Activity Logs.
4. Select the appropriate Subscription.
5. Click Edit setting next to a diagnostic setting.
6. Ensure that the following categories are checked: Administrative, Alert, Policy, and Security.

Using Azure CLI

Ensure the categories 'Administrative', 'Alert', 'Policy', and 'Security' set to: 'enabled: true'

az monitor diagnostic-settings subscription list --subscription <subscription ID>

Using PowerShell

Ensure the categories Administrative, Alert, Policy, and Security are set to Enabled:True

Get-AzSubscriptionDiagnosticSetting -Subscription <subscriptionID>

Expected Result

The Diagnostic Setting should have the categories Administrative, Alert, Policy, and Security all enabled.

Remediation

Remediate from Azure Portal

1. Go to Monitor.
2. Click Activity log.
3. Click on Export Activity Logs.
4. Select the Subscription from the drop down menu.
5. Click Edit setting next to a diagnostic setting.
6. Check the following categories: Administrative, Alert, Policy, and Security.
7. Choose the destination details according to your organization's needs.
8. Click Save.

Remediate from Azure CLI

az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>]> --logs "[{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}]"

Remediate from PowerShell

$logCategories = @();
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true

New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories

Default Value

When the diagnostic setting is created using Azure Portal, by default no categories are selected.

References

1. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings
2. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-manager-diagnostic-settings
3. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
4. https://learn.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest
5. https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azsubscriptiondiagnosticsetting?view=azps-13.4.0

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated