> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Activity Log Alert exists for Create or Update Security Policy

### More Info:

Monitoring for Create or Update Security Policy events gives insight into changes to security policy and may reduce the time it takes to detect suspicious activity.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Security Policy" in Azure using the Azure console, follow the below steps:

        1. Open the Azure Portal and navigate to the resource group that contains the security policy you want to monitor.
        2. Click on "Activity Log" in the left-hand menu.
        3. Click on "Alerts" in the Activity Log blade.
        4. Click on "+ New alert rule" to create a new alert rule.
        5. In the "Create alert rule" blade, select the "Activity Log" option under "Resource" and select the appropriate subscription from the drop-down menu.
        6. Under "Condition", select "Signal logic" and then select "Activity log".
        7. In the "Activity log" blade, select "Event category" and then select "Administrative".
        8. Under "Event types", select "Write" and then select "Microsoft.Network/networkSecurityGroups/write".
        9. Under "Filter", select "Add filter" and then select "Resource ID".
        10. Enter the resource ID of the security policy you want to monitor.
        11. Under "Actions", select "Add action group" and then select "Create action group".
        12. In the "Create action group" blade, enter a name for the action group and select the appropriate subscription, resource group, and region.
        13. Under "Actions", select "Add action" and then select "Email/SMS/Push/Voice".
        14. Enter the email address of the person or group who should receive alerts.
        15. Click on "Create" to create the alert rule.

        By following the above steps, you will be able to create an activity log alert for the create or update security policy in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Security Policy" in Azure using Azure CLI, follow the below steps:

        Step 1: Open Azure CLI and login to your Azure account using the below command:

        ```
        az login
        ```

        Step 2: Once you are logged in, set the default subscription where your resources are deployed using the below command:

        ```
        az account set --subscription <subscription-id>
        ```

        Step 3: Create an Activity Log Alert using the below command:

        ```
        az monitor activity-log alert create --name <alert-name> --resource-group <resource-group-name> --condition category=Policy --action-group <action-group-id> --description "Alert for Create or Update Security Policy"
        ```

        Note: Replace `<alert-name>`, `<resource-group-name>` and `<action-group-id>` with the appropriate values.

        Step 4: Verify the Activity Log Alert using the below command:

        ```
        az monitor activity-log alert show --name <alert-name> --resource-group <resource-group-name>
        ```

        Note: Replace `<alert-name>` and `<resource-group-name>` with the appropriate values.

        Step 5: If the output of the above command shows the details of the Activity Log Alert, then the remediation is successful.

        By following the above steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Security Policy" in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Security Policy" in Azure using Python, you can follow the below steps:

        1. Install the Azure SDK for Python using the following command:

        ```python theme={null}
        pip install azure-mgmt-monitor
        ```

        2. Authenticate to Azure using the Azure SDK for Python. You can use the following code to authenticate using a Service Principal:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials

        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        CLIENT_SECRET = '<your client secret>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )
        ```

        3. Use the Azure SDK for Python to check if an Activity Log Alert exists for Create or Update Security Policy. You can use the following code to check if the alert exists:

        ```python theme={null}
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.mgmt.monitor.models import AlertRuleResource

        SUBSCRIPTION_ID = '<your subscription id>'
        RESOURCE_GROUP_NAME = '<your resource group name>'
        ALERT_RULE_NAME = '<your alert rule name>'

        monitor_client = MonitorManagementClient(credentials, SUBSCRIPTION_ID)

        alert_rule = monitor_client.alert_rules.get(
            resource_group_name=RESOURCE_GROUP_NAME,
            rule_name=ALERT_RULE_NAME
        )

        if isinstance(alert_rule, AlertRuleResource) and alert_rule.condition.all_of[0].field == 'resourceType' and alert_rule.condition.all_of[0].equals == 'Microsoft.Network/networkSecurityGroups' and alert_rule.condition.all_of[1].field == 'operationName' and alert_rule.condition.all_of[1].equals == 'Microsoft.Network/networkSecurityGroups/securityRules/write':
            print('Activity Log Alert exists for Create or Update Security Policy')
        else:
            print('Activity Log Alert does not exist for Create or Update Security Policy')
        ```

        4. If the alert does not exist, use the Azure SDK for Python to create the Activity Log Alert. You can use the following code to create the alert:

        ```python theme={null}
        from azure.mgmt.monitor.models import AlertRuleAllOfCondition, AlertRuleAnyOfOrLeafCondition, AlertRuleActionGroup, AlertRuleActionList, AlertRuleEmailAction, AlertRuleResource

        ACTION_GROUP_ID = '<your action group id>'
        ALERT_RULE_NAME = '<your alert rule name>'

        condition = AlertRuleAllOfCondition(
            all_of=[
                AlertRuleAnyOfOrLeafCondition(
                    field='resourceType',
                    equals='Microsoft.Network/networkSecurityGroups'
                ),
                AlertRuleAnyOfOrLeafCondition(
                    field='operationName',
                    equals='Microsoft.Network/networkSecurityGroups/securityRules/write'
                )
            ]
        )

        action_group = AlertRuleActionGroup(
            action_group_id=ACTION_GROUP_ID
        )

        action_list = AlertRuleActionList(
            email_actions=[
                AlertRuleEmailAction(
                    send_to_service_owners=True
                )
            ],
            action_groups=[
                action_group
            ]
        )

        alert_rule = AlertRuleResource(
            location='global',
            alert_rule_name=ALERT_RULE_NAME,
            description='Activity Log Alert for Create or Update Security Policy',
            condition=condition,
            actions=action_list,
            is_enabled=True
        )

        monitor_client.alert_rules.create_or_update(
            resource_group_name=RESOURCE_GROUP_NAME,
            rule_name=ALERT_RULE_NAME,
            parameters=alert_rule
        )

        print('Activity Log Alert created for Create or Update Security Policy')
        ```

        By following the above steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Security Policy" in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_monitor_activity_log_alert" "security_policy_create_update" {
          name                = "activity-log-alert-security-policy-create-update"
          resource_group_name = "RESOURCE_GROUP_NAME"              # replace with the resource group to hold the alert
          scopes              = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription ID
          description         = "Alert on Create or Update Security Policy operations"

          enabled = true

          criteria {
            category = "Administrative"

            operation_name = "Microsoft.Security/policies/write"
          }

          action {
            action_group_id = azurerm_monitor_action_group.security_alerts.id
          }
        }

        resource "azurerm_monitor_action_group" "security_alerts" {
          name                = "ag-security-alerts"
          resource_group_name = "RESOURCE_GROUP_NAME" # same or another RG for action groups
          short_name          = "secalerts"

          email_receiver {
            name          = "secops-email"
            email_address = "SECOPS_EMAIL_ADDRESS" # replace with your security/SOC email
          }
        }
        ```

        This change does not force replacement of existing workloads; it only adds a new alert and action group. After `terraform apply`, `terraform plan` should show `azurerm_monitor_activity_log_alert.security_policy_create_update` (and `azurerm_monitor_action_group.security_alerts` if new) as `+ create` with the criteria `operation_name = "Microsoft.Security/policies/write"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log](https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log)