Ensure that Azure Monitor Diagnostic Settings are configured to export activity logs for the selected Microsoft Azure subscription. This helps in maintaining a record of all operational actions which are crucial for security and operational auditing.
PoC代码[已公开]
id: azure-monitor-diagnostic-unrestricted
info:
name: Azure Monitor Diagnostic Settings for Subscription Activity Log Export Check
author: princechaddha
severity: medium
description: |
Ensure that Azure Monitor Diagnostic Settings are configured to export activity logs for the selected Microsoft Azure subscription. This helps in maintaining a record of all operational actions which are crucial for security and operational auditing.
impact: |
Not having diagnostic settings configured to export activity logs can lead to a lack of visibility into operational actions within the subscription, increasing the risk of undetected malicious activities or misconfigurations.
remediation: |
Configure Azure Monitor Diagnostic Settings to export activity logs. Refer to the Azure documentation on how to set up diagnostic settings for activity log export.
reference:
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
tags: cloud,devops,azure,microsoft,monitor,azure-cloud-config
self-contained: true
code:
- engine:
- sh
- bash
source: |
az monitor diagnostic-settings subscription list --query 'value[*].id' --output json
matchers:
- type: word
words:
- '[]'
extractors:
- type: dsl
dsl:
- '"Azure Monitor Diagnostic Settings for Subscription Activity Log Export are not configured."'
# digest: 4a0a00473045022014d2afe58bb4a187acb33961c47d8ea3a7a5b4ce4f95441247c802c6216be9df022100de89117ba583753296ad5d8b3317251c4acd742c9bd5b00d7bda8c7e756d7947:922c64590222798bb761d5b6d8e72950