> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Activity Log Alert exists for Create Policy Assignment ### More Info: Monitoring for create policy assignment events gives insight into changes done in azure policy - assignments and may reduce the time it takes to detect unsolicited changes. ### Risk Level Low ### Address Operational Maturity, Security ### Compliance Standards * CIS AZURE * Cloudanix Best Practice * HIPAA * ISO 27001 * NIST CSF * PCI * SOC2 ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the misconfiguration "Ensure Activity Log Alert exists for Create Policy Assignment" in Azure using the Azure console: 1. Log in to the Azure portal using your credentials. 2. Click on the "Monitor" option from the left-hand side menu. 3. Click on the "Activity log alerts" option from the "Monitor" menu. 4. Click on the "New alert rule" button to create a new alert rule. 5. In the "Basics" tab, provide a name for the alert rule and select the subscription to which it applies. 6. In the "Condition" tab, select the "Signal logic" as "Activity log". 7. In the "Target" section, select "Resource Manager" as the "Resource type". 8. In the "Event types" section, select "Policy Assignment Created" as the event type. 9. In the "Actions" tab, select the "Action group" that you want to associate with this alert rule. 10. In the "Review + create" tab, review the alert rule configuration and click on the "Create" button to create the alert rule. Once the alert rule is created, you will receive notifications whenever a policy assignment is created in your Azure environment. This will help you to ensure that all policy assignments are being created as per the defined policies and standards. # To remediate the misconfiguration "Ensure Activity Log Alert exists for Create Policy Assignment" in AZURE using AZURE CLI, follow the below steps: 1. Open the AZURE CLI on your local machine or connect to the AZURE CLI in the AZURE portal. 2. Run the following command to check if an activity log alert exists for Create Policy Assignment: ``` az monitor activity-log alert list --query "[?contains(name, 'Create Policy Assignment')]" ``` If the command returns an empty array, then there is no activity log alert for Create Policy Assignment. 3. Run the following command to create an activity log alert for Create Policy Assignment: ``` az monitor activity-log alert create --name "Create Policy Assignment Alert" --description "Alert for Create Policy Assignment" --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write --action-group ``` Replace `` with the ID of the action group that you want to use for this alert. 4. Run the following command to verify that the activity log alert has been created: ``` az monitor activity-log alert list --query "[?contains(name, 'Create Policy Assignment')]" ``` The command should return the details of the newly created activity log alert. By following these steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Create Policy Assignment" in AZURE using AZURE CLI. To remediate the misconfiguration "Ensure Activity Log Alert exists for Create Policy Assignment" in Azure using Python, you can follow these steps: 1. Import the necessary libraries: ``` from azure.mgmt.monitor import MonitorManagementClient from azure.identity import ClientSecretCredential ``` 2. Set the Azure credentials: ``` tenant_id = '' client_id = '' client_secret = '' subscription_id = '' credentials = ClientSecretCredential( tenant_id=tenant_id, client_id=client_id, client_secret=client_secret ) ``` 3. Create a MonitorManagementClient: ``` monitor_client = MonitorManagementClient( credentials=credentials, subscription_id=subscription_id ) ``` 4. Define the activity log alert properties: ``` activity_log_alert_properties = { 'name': 'create-policy-assignment-alert', 'description': 'Activity log alert for create policy assignment', 'enabled': True, 'condition': { 'allOf': [ { 'field': 'category', 'equals': 'Policy' }, { 'field': 'operationName', 'equals': 'Microsoft.Authorization/policyAssignments/write' }, { 'field': 'resourceType', 'equals': 'Microsoft.Authorization/policyAssignments' } ] }, 'actions': { 'action_groups': [ { 'action_group_id': '/subscriptions//resourceGroups//providers/microsoft.insights/actionGroups/' } ] } } ``` 5. Create the activity log alert: ``` monitor_client.activity_log_alerts.create_or_update( resource_group_name='', activity_log_alert_name=activity_log_alert_properties['name'], parameters=activity_log_alert_properties ) ``` 6. Verify that the activity log alert has been created successfully: ``` activity_log_alert = monitor_client.activity_log_alerts.get( resource_group_name='', activity_log_alert_name=activity_log_alert_properties['name'] ) print(activity_log_alert) ``` These steps will create an activity log alert in Azure that will trigger when a policy assignment is created. You can customize the alert properties as necessary to meet your specific requirements. ```hcl theme={null} resource "azurerm_monitor_activity_log_alert" "create_policy_assignment" { name = "create-policy-assignment-alert" resource_group_name = "RESOURCE_GROUP_NAME" # replace with your resource group scopes = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription ID description = "Alert on creation of Azure Policy Assignments" enabled = true criteria { category = "Policy" operation_name = "Microsoft.Authorization/policyAssignments/write" # No threshold: each matching event triggers the alert } action { action_group_id = azurerm_monitor_action_group.policy_alerts.id } # Optional tags tags = { environment = "ENVIRONMENT_TAG" # e.g. "prod" } } resource "azurerm_monitor_action_group" "policy_alerts" { name = "policy-assignment-alert-ag" resource_group_name = "RESOURCE_GROUP_NAME" # replace with your resource group short_name = "polasg" email_receiver { name = "policy-alert-email" email_address = "ALERT_EMAIL_ADDRESS" # replace with target email } } ``` This adds an Activity Log Alert specifically for the “Create Policy Assignment” operation; no existing resources are replaced. After you add this, `terraform plan` should show one new `azurerm_monitor_activity_log_alert` and one new `azurerm_monitor_action_group` to be created, with criteria `category = "Policy"` and `operation_name = "Microsoft.Authorization/policyAssignments/write"`. ### Additional Reading: * [https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log](https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log)