> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure log profile is configured for all regions

### More Info:

Configure the log profile to export activities from all Azure supported regions/locations including global.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* GDPR
* HIPAA
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure log profile is configured for all regions" for Azure using the Azure console, you can follow the below steps:

        1. Log in to the Azure portal using your credentials.
        2. From the left-hand side menu, select "Log Analytics workspaces".
        3. Select the workspace you want to configure for all regions.
        4. Click on "Advanced settings" under the "Settings" section of the left-hand side menu.
        5. Under "Data", select "Log profiles".
        6. Click on "Add" to create a new log profile.
        7. In the "Add log profile" window, enter a name for the log profile.
        8. Under the "Regions" section, select "All regions".
        9. Under the "Categories" section, select the categories of logs you want to collect.
        10. Under the "Destination" section, select the destination where you want to send the logs.
        11. Click on "OK" to save the log profile.

        By following these steps, you will remediate the misconfiguration "Ensure log profile is configured for all regions" for Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure log profile is configured for all regions" for AZURE using AZURE CLI, you can follow the below steps:

        Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell.

        Step 2: Run the following command to list all the available regions in your AZURE subscription:

        ```
        az account list-locations --query [*].name
        ```

        Step 3: Run the following command to create a log profile for each region:

        ```
        for region in $(az account list-locations --query [*].name -o tsv); do az monitor log-profiles create --locations $region --categories Write --enabled true --days 30 --name default; done
        ```

        This command will create a log profile named "default" for each region and enable it for 30 days.

        Step 4: Verify that the log profiles have been created for all regions by running the following command:

        ```
        az monitor log-profiles list --query [*].locations
        ```

        This command will list all the locations where the log profiles have been created.

        Step 5: Finally, you can validate the remediation by ensuring that the log profiles are configured for all regions.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure log profile is configured for all regions" in Azure using Python, follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.common.credentials import ServicePrincipalCredentials
        ```

        2. Set the required Azure credentials:

        ```python theme={null}
        credentials = ServicePrincipalCredentials(
            client_id='<client-id>',
            secret='<client-secret>',
            tenant='<tenant-id>'
        )
        ```

        3. Initialize the MonitorManagementClient:

        ```python theme={null}
        client = MonitorManagementClient(
            credentials=credentials,
            subscription_id='<subscription-id>'
        )
        ```

        4. Get a list of all the regions:

        ```python theme={null}
        regions = [region.name for region in client.locations.list()]
        ```

        5. For each region, check if a log profile exists:

        ```python theme={null}
        for region in regions:
            log_profile = client.log_profiles.get(
                resource_group_name='<resource-group-name>',
                name='<log-profile-name>',
                location=region
            )
            
            if not log_profile:
                # If the log profile doesn't exist, create it
                client.log_profiles.create_or_update(
                    resource_group_name='<resource-group-name>',
                    log_profile_name='<log-profile-name>',
                    parameters={
                        'location': region,
                        'categories': {
                            'write': True,
                            'delete': True
                        }
                    }
                )
        ```

        6. Save the Python script and run it to remediate the misconfiguration.

        Note: Replace the placeholders `<client-id>`, `<client-secret>`, `<tenant-id>`, `<subscription-id>`, `<resource-group-name>`, and `<log-profile-name>` with the actual values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_monitor_log_profile" "activity_logs_all_regions" {
          name = "LOG_PROFILE_NAME" # replace with your log profile name

          # Export all activity log categories (adjust only if your policy requires specific ones)
          categories = [
            "Action",
            "Delete",
            "Write",
          ]

          # The key fix: include ALL Azure regions plus "global"
          # Replace the list below with the exact set of regions you use,
          # making sure "global" is present.
          locations = [
            "global",
            "eastus",
            "eastus2",
            "westus",
            "westus2",
            "centralus",
            "northcentralus",
            "southcentralus",
            # ...ADD ALL OTHER SUPPORTED AZURE REGIONS REQUIRED BY YOUR POLICY...
          ]

          retention_policy {
            enabled = true
            days    = RETENTION_DAYS # replace with the required retention period (integer)
          }

          storage_account_id = azurerm_storage_account.LOG_STORAGE_ACCOUNT_NAME.id
          # replace LOG_STORAGE_ACCOUNT_NAME with the Terraform resource name
          # for your log archive storage account
        }
        ```

        `terraform plan` should show the `azurerm_monitor_log_profile` resource being created or updated so that its `locations` list includes `"global"` and all required Azure regions.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest%23az-monitor-log-profiles-update](https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest%23az-monitor-log-profiles-update)