Ensure Activity Log Alert exists for Create or Update Security Policy

More Info:

Monitoring for Create or Update Security Policy events gives insight into changes to security policy and may reduce the time it takes to detect suspicious activity.

Risk Level

Low

Address

Operational Maturity, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration “Ensure Activity Log Alert exists for Create or Update Security Policy” in Azure using the Azure console, follow the below steps:

1. Open the Azure Portal and navigate to the resource group that contains the security policy you want to monitor.
2. Click on “Activity Log” in the left-hand menu.
3. Click on “Alerts” in the Activity Log blade.
4. Click on ”+ New alert rule” to create a new alert rule.
5. In the “Create alert rule” blade, select the “Activity Log” option under “Resource” and select the appropriate subscription from the drop-down menu.
6. Under “Condition”, select “Signal logic” and then select “Activity log”.
7. In the “Activity log” blade, select “Event category” and then select “Administrative”.
8. Under “Event types”, select “Write” and then select “Microsoft.Network/networkSecurityGroups/write”.
9. Under “Filter”, select “Add filter” and then select “Resource ID”.
10. Enter the resource ID of the security policy you want to monitor.
11. Under “Actions”, select “Add action group” and then select “Create action group”.
12. In the “Create action group” blade, enter a name for the action group and select the appropriate subscription, resource group, and region.
13. Under “Actions”, select “Add action” and then select “Email/SMS/Push/Voice”.
14. Enter the email address of the person or group who should receive alerts.
15. Click on “Create” to create the alert rule.

By following the above steps, you will be able to create an activity log alert for the create or update security policy in Azure.

Using CLI

To remediate the misconfiguration “Ensure Activity Log Alert exists for Create or Update Security Policy” in Azure using Azure CLI, follow the below steps:

Step 1: Open Azure CLI and login to your Azure account using the below command:

az login

Step 2: Once you are logged in, set the default subscription where your resources are deployed using the below command:

az account set --subscription <subscription-id>

Step 3: Create an Activity Log Alert using the below command:

az monitor activity-log alert create --name <alert-name> --resource-group <resource-group-name> --condition category=Policy --action-group <action-group-id> --description "Alert for Create or Update Security Policy"

Note: Replace <alert-name>, <resource-group-name> and <action-group-id> with the appropriate values.

Step 4: Verify the Activity Log Alert using the below command:

az monitor activity-log alert show --name <alert-name> --resource-group <resource-group-name>

Note: Replace <alert-name> and <resource-group-name> with the appropriate values.

Step 5: If the output of the above command shows the details of the Activity Log Alert, then the remediation is successful.

By following the above steps, you can remediate the misconfiguration “Ensure Activity Log Alert exists for Create or Update Security Policy” in Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Ensure Activity Log Alert exists for Create or Update Security Policy” in Azure using Python, you can follow the below steps:

1. Install the Azure SDK for Python using the following command:

pip install azure-mgmt-monitor

2. Authenticate to Azure using the Azure SDK for Python. You can use the following code to authenticate using a Service Principal:

from azure.common.credentials import ServicePrincipalCredentials

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
CLIENT_SECRET = '<your client secret>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

3. Use the Azure SDK for Python to check if an Activity Log Alert exists for Create or Update Security Policy. You can use the following code to check if the alert exists:

from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import AlertRuleResource

SUBSCRIPTION_ID = '<your subscription id>'
RESOURCE_GROUP_NAME = '<your resource group name>'
ALERT_RULE_NAME = '<your alert rule name>'

monitor_client = MonitorManagementClient(credentials, SUBSCRIPTION_ID)

alert_rule = monitor_client.alert_rules.get(
    resource_group_name=RESOURCE_GROUP_NAME,
    rule_name=ALERT_RULE_NAME
)

if isinstance(alert_rule, AlertRuleResource) and alert_rule.condition.all_of[0].field == 'resourceType' and alert_rule.condition.all_of[0].equals == 'Microsoft.Network/networkSecurityGroups' and alert_rule.condition.all_of[1].field == 'operationName' and alert_rule.condition.all_of[1].equals == 'Microsoft.Network/networkSecurityGroups/securityRules/write':
    print('Activity Log Alert exists for Create or Update Security Policy')
else:
    print('Activity Log Alert does not exist for Create or Update Security Policy')

4. If the alert does not exist, use the Azure SDK for Python to create the Activity Log Alert. You can use the following code to create the alert:

from azure.mgmt.monitor.models import AlertRuleAllOfCondition, AlertRuleAnyOfOrLeafCondition, AlertRuleActionGroup, AlertRuleActionList, AlertRuleEmailAction, AlertRuleResource

ACTION_GROUP_ID = '<your action group id>'
ALERT_RULE_NAME = '<your alert rule name>'

condition = AlertRuleAllOfCondition(
    all_of=[
        AlertRuleAnyOfOrLeafCondition(
            field='resourceType',
            equals='Microsoft.Network/networkSecurityGroups'
        ),
        AlertRuleAnyOfOrLeafCondition(
            field='operationName',
            equals='Microsoft.Network/networkSecurityGroups/securityRules/write'
        )
    ]
)

action_group = AlertRuleActionGroup(
    action_group_id=ACTION_GROUP_ID
)

action_list = AlertRuleActionList(
    email_actions=[
        AlertRuleEmailAction(
            send_to_service_owners=True
        )
    ],
    action_groups=[
        action_group
    ]
)

alert_rule = AlertRuleResource(
    location='global',
    alert_rule_name=ALERT_RULE_NAME,
    description='Activity Log Alert for Create or Update Security Policy',
    condition=condition,
    actions=action_list,
    is_enabled=True
)

monitor_client.alert_rules.create_or_update(
    resource_group_name=RESOURCE_GROUP_NAME,
    rule_name=ALERT_RULE_NAME,
    parameters=alert_rule
)

print('Activity Log Alert created for Create or Update Security Policy')

By following the above steps, you can remediate the misconfiguration “Ensure Activity Log Alert exists for Create or Update Security Policy” in Azure using Python.

Using Terraform

resource "azurerm_monitor_activity_log_alert" "security_policy_create_update" {
  name                = "activity-log-alert-security-policy-create-update"
  resource_group_name = "RESOURCE_GROUP_NAME"              # replace with the resource group to hold the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription ID
  description         = "Alert on Create or Update Security Policy operations"

  enabled = true

  criteria {
    category = "Administrative"

    operation_name = "Microsoft.Security/policies/write"
  }

  action {
    action_group_id = azurerm_monitor_action_group.security_alerts.id
  }
}

resource "azurerm_monitor_action_group" "security_alerts" {
  name                = "ag-security-alerts"
  resource_group_name = "RESOURCE_GROUP_NAME" # same or another RG for action groups
  short_name          = "secalerts"

  email_receiver {
    name          = "secops-email"
    email_address = "SECOPS_EMAIL_ADDRESS" # replace with your security/SOC email
  }
}

This change does not force replacement of existing workloads; it only adds a new alert and action group. After terraform apply, terraform plan should show azurerm_monitor_activity_log_alert.security_policy_create_update (and azurerm_monitor_action_group.security_alerts if new) as + create with the criteria operation_name = "Microsoft.Security/policies/write".

Additional Reading:

• https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log