> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Activity Log Alert exists for Delete Network Security Group Rule ### More Info: Monitoring for Delete Network Security Group Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity. ### Risk Level Low ### Address Operational Maturity, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AZURE * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Network Security Group Rule" for Azure using Azure console, follow the below steps: 1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Select the subscription for which you want to remediate the misconfiguration. 3. Click on the "Activity log alerts" option from the left-hand side menu. 4. Click on the "+ Add activity log alert" button to create a new alert. 5. In the "Basics" tab, provide a name for the alert, select the subscription, and resource group for which you want to create the alert. 6. In the "Condition" tab, select the "Delete Network Security Group Rule" option from the "Event name" dropdown. 7. In the "Actions" tab, select the action you want to take when the alert is triggered. You can choose to send an email, a webhook, or a SMS message. 8. In the "Review + create" tab, review the alert configuration and click on the "Create" button to create the alert. Once the alert is created, it will trigger whenever a network security group rule is deleted, and you will receive a notification based on the action you have configured. This will help you to identify and prevent accidental or unauthorized deletion of network security group rules. # To remediate the misconfiguration of missing Activity Log Alert for Delete Network Security Group Rule in AZURE using AZURE CLI, follow the below steps: Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell. Step 2: Check if the Activity Log Alert exists for Delete Network Security Group Rule by running the following command: ``` az monitor activity-log alert list --query "[?contains(details.action, 'Microsoft.Network/networkSecurityGroups/securityRules/delete')]" ``` This command will list all the Activity Log Alerts that exist for the Delete Network Security Group Rule. Step 3: If the Activity Log Alert does not exist, create a new one by running the following command: ``` az monitor activity-log alert create --name --resource-group --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/securityRules/delete --action-group ``` Replace `` with the name you want to give to the new Activity Log Alert, `` with the name of the resource group where the security group is located, and `` with the ID of the action group that should be notified when the Activity Log Alert is triggered. Step 4: Verify if the Activity Log Alert is created successfully by running the following command: ``` az monitor activity-log alert list --query "[?contains(details.action, 'Microsoft.Network/networkSecurityGroups/securityRules/delete')]" ``` This command will list all the Activity Log Alerts that exist for the Delete Network Security Group Rule, and the newly created Activity Log Alert should be listed. By following these steps, you can remediate the misconfiguration of missing Activity Log Alert for Delete Network Security Group Rule in AZURE using AZURE CLI. To remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Network Security Group Rule" in Azure using Python, you can follow the below steps: Step 1: Install the Azure Python SDK using the following command: ``` pip install azure-mgmt-monitor ``` Step 2: Authenticate to Azure using the Azure CLI or using a Service Principal. Step 3: Use the following Python code to create an Activity Log alert for the Delete Network Security Group Rule: ```python theme={null} from azure.mgmt.monitor import MonitorManagementClient from azure.mgmt.monitor.models import * # Replace with your Subscription Id subscription_id = '' # Replace with the name of the Resource Group where the Network Security Group is located resource_group_name = '' # Replace with the name of the Network Security Group network_security_group_name = '' # Replace with the name of the Activity Log Alert activity_log_alert_name = '' # Create a Monitor Management Client monitor_client = MonitorManagementClient( credential=credentials, subscription_id=subscription_id ) # Create a condition for the Activity Log Alert condition = ManagementEventRuleCondition( all_of=[ ManagementEventAggregationCondition( field='category', equals='Administrative' ), ManagementEventAggregationCondition( field='resourceId', equals=f'/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.Network/networkSecurityGroups/{network_security_group_name}' ), ManagementEventAggregationCondition( field='operationName', equals='Microsoft.Network/networkSecurityGroups/securityRules/delete' ) ] ) # Create an Action Group for the Activity Log Alert action_group = ActionGroup( group_short_name='Email Action Group', email_receivers=[ ActionGroupReceiver( name='Email Receiver', email_address='youremail@example.com' ) ] ) # Create the Activity Log Alert monitor_client.alert_rules.create_or_update( resource_group_name=resource_group_name, rule_name=activity_log_alert_name, parameters=ActivityLogAlert( location='global', enabled=True, condition=condition, actions=[action_group] ) ) ``` In the above code, replace the placeholders ``, ``, `` and `` with the appropriate values. This code will create an Activity Log Alert for the Delete Network Security Group Rule in Azure. When this rule is triggered, an email will be sent to the specified email address. ```hcl theme={null} resource "azurerm_monitor_activity_log_alert" "delete_nsg_rule" { name = "DELETE-NSG-RULE-ALERT" resource_group_name = "RESOURCE_GROUP_FOR_ALERT" # replace with the resource group where you want the alert resource to live scopes = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription (or specific NSG resource IDs) description = "Alert on Delete Network Security Group Rule operations" enabled = true criteria { category = "Administrative" operation_name = "Microsoft.Network/networkSecurityGroups/securityRules/delete" } action { action_group_id = azurerm_monitor_action_group.nsg_alerts.id } tags = { Environment = "ENVIRONMENT_TAG" # optional; replace or remove as needed } } resource "azurerm_monitor_action_group" "nsg_alerts" { name = "nsg-delete-rule-alert-ag" resource_group_name = "RESOURCE_GROUP_FOR_ALERT" # same as above or another RG if desired short_name = "nsgdelag" email_receiver { name = "nsg-delete-rule-email" email_address = "ALERT_RECIPIENT_EMAIL" # replace with real email } } ``` This adds a new Activity Log Alert; it does not replace existing resources. After you add this, `terraform plan` should show one new `azurerm_monitor_activity_log_alert` (and one new `azurerm_monitor_action_group` if you didn’t have one already) with `criteria.operation_name = "Microsoft.Network/networkSecurityGroups/securityRules/delete"`. ### Additional Reading: * [https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log](https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log)