> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Alert for Create or Update Security Solution Events

### More Info:

Security solution changes have been detected within your Microsoft Azure cloud account.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* HIPAA
* ISO 27001

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step by step instructions to remediate the misconfiguration of "Create Alert for Create or Update Security Solution Events" for Azure using Azure console:

        1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Click on "All services" on the left-hand side of the page and search for "Security Center" in the search bar.
        3. Click on "Security Center" and select "Security policy" from the left-hand side menu.
        4. In the "Security policy" page, click on the "Edit" button to edit the security policy.
        5. Scroll down to the "Activity log alerts" section and click on the "Add activity log alert" button.
        6. In the "Add activity log alert" page, fill in the required fields:
           * Name: Enter a name for the alert.
           * Description: Enter a description for the alert.
           * Subscription: Select the subscription in which you want to create the alert.
           * Resource group: Select the resource group in which you want to create the alert.
           * Event category: Select "Security" from the drop-down menu.
           * Event type: Select "Microsoft.Security/complianceResults/write" from the drop-down menu.
           * Severity: Select the severity level for the alert.
           * Action group: Select an action group to trigger when the alert is fired.
           * Tags: Add relevant tags if required.
        7. Click on the "OK" button to create the alert.

        Once the above steps are completed, you will have successfully remediated the misconfiguration of "Create Alert for Create or Update Security Solution Events" for Azure using Azure console. The alert will now be triggered whenever there is a "Create or Update Security Solution" event in your Azure environment.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Create Alert for 'Create or Update Security Solution' Events" in Azure using Azure CLI, follow the below steps:

        Step 1: Open the Azure CLI in your local machine or Azure portal.

        Step 2: Run the following command to create an alert rule for "Create or Update Security Solution" events:

        ```
        az monitor metrics alert create -n <Alert_Rule_Name> --description <Description> --resource <Resource_ID> --condition "category=ServiceHealth severity=Error" --action <Action_Group_ID>
        ```

        Here, replace the `<Alert_Rule_Name>` with the name of the alert rule you want to create, `<Description>` with the description of the alert rule, `<Resource_ID>` with the ID of the resource for which you want to create the alert, and `<Action_Group_ID>` with the ID of the action group to which you want to send the alert notification.

        Step 3: Verify the alert rule by running the following command:

        ```
        az monitor metrics alert show -n <Alert_Rule_Name> -g <Resource_Group_Name>
        ```

        Here, replace the `<Alert_Rule_Name>` with the name of the alert rule you created in step 2, and `<Resource_Group_Name>` with the name of the resource group where the resource is located.

        Step 4: If the alert rule is working correctly, you will receive notifications whenever a "Create or Update Security Solution" event occurs.

        Note: You can also create the alert rule using the Azure portal or Azure PowerShell.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this misconfiguration in Azure, you can use the Azure SDK for Python to create an alert for "Create or Update Security Solution" events. Here are the steps:

        1. Install the Azure SDK for Python by running the following command in your terminal:

        ```
        pip install azure-mgmt-monitor
        ```

        2. Import the necessary modules in your Python script:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.mgmt.monitor.models import RuleCondition, ManagementEventRuleCondition, ManagementEventAggregationCondition, \
            RuleAction, AlertRuleResource, AlertRuleAllOfCondition, AlertRuleLeafCondition, AlertRuleAnyOfOrLeafCondition
        ```

        3. Set up your Azure credentials by creating a Service Principal and assigning it the necessary permissions. You will need the following information:

        * Subscription ID
        * Tenant ID
        * Client ID
        * Client Secret

        ```python theme={null}
        subscription_id = '<your-subscription-id>'
        tenant_id = '<your-tenant-id>'
        client_id = '<your-client-id>'
        client_secret = '<your-client-secret>'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=client_secret,
            tenant=tenant_id
        )
        ```

        4. Create an instance of the `MonitorManagementClient`:

        ```python theme={null}
        monitor_client = MonitorManagementClient(credentials, subscription_id)
        ```

        5. Define the conditions for the alert rule. In this case, we want to create an alert for "Create or Update Security Solution" events. We will use the `ManagementEventRuleCondition` to specify this:

        ```python theme={null}
        management_event_condition = ManagementEventRuleCondition(
            all_of=[AlertRuleAllOfCondition(
                field='operationName',
                equals='Microsoft.Security/securitySolutions/write'
            )]
        )
        ```

        6. Define the actions to take when the alert is triggered. In this case, we will send an email to a specified email address:

        ```python theme={null}
        action_group_id = '<your-action-group-id>'

        action = RuleAction(
            action_group_id=action_group_id
        )
        ```

        7. Create the alert rule:

        ```python theme={null}
        alert_rule = AlertRuleResource(
            location='global',
            alert_rule_resource_name='security-solution-create-update',
            description='Alert for Create or Update Security Solution events',
            condition=AlertRuleLeafCondition(
                all_of=[AlertRuleAnyOfOrLeafCondition(
                    management_event=management_event_condition
                )]
            ),
            actions=[action],
            is_enabled=True
        )

        monitor_client.alert_rules.create_or_update(
            resource_group_name='<your-resource-group-name>',
            rule_name='security-solution-create-update',
            parameters=alert_rule
        )
        ```

        This will create an alert rule in Azure that will trigger an email notification when a "Create or Update Security Solution" event occurs. You can customize the alert rule by changing the conditions and actions as needed.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Replace the placeholders with your actual values:
        # - SUBSCRIPTION_ID: the subscription to monitor
        # - RESOURCE_GROUP_NAME: where to place the alert and action group
        # - LOCATION: Azure region (e.g. "eastus")
        # - ALERT_NAME: friendly name for the alert rule
        # - ACTION_GROUP_NAME: friendly name for the action group
        # - ACTION_GROUP_SHORT_NAME: short name (2–12 characters)
        # - EMAIL_RECEIVER_NAME / EMAIL_ADDRESS: who should be notified

        data "azurerm_subscription" "current" {
          subscription_id = "SUBSCRIPTION_ID"
        }

        resource "azurerm_resource_group" "monitor_rg" {
          name     = "RESOURCE_GROUP_NAME"
          location = "LOCATION"
        }

        resource "azurerm_monitor_action_group" "security_solution_changes" {
          name                = "ACTION_GROUP_NAME"
          resource_group_name = azurerm_resource_group.monitor_rg.name
          short_name          = "ACTION_GROUP_SHORT_NAME"

          email_receiver {
            name                    = "EMAIL_RECEIVER_NAME"
            email_address           = "EMAIL_ADDRESS"
            use_common_alert_schema = true
          }
        }

        resource "azurerm_monitor_activity_log_alert" "security_solution_create_update" {
          name                = "ALERT_NAME"
          resource_group_name = azurerm_resource_group.monitor_rg.name
          scopes              = [data.azurerm_subscription.current.id]
          description         = "Alert on Create or Update Security Solution events in Activity Log"

          criteria {
            category       = "Security"
            operation_name = "Create or Update Security Solution"
          }

          action {
            action_group_id = azurerm_monitor_action_group.security_solution_changes.id
          }

          # Optional: ensure the alert is enabled
          enabled = true
        }
        ```

        This configuration creates an Azure Monitor Activity Log alert that fires whenever a “Create or Update Security Solution” event is logged and sends notifications via the configured action group.

        After updating your Terraform, `terraform plan` should show one new `azurerm_monitor_action_group` and one new `azurerm_monitor_activity_log_alert` to be created, with the `criteria.operation_name` exactly set to `"Create or Update Security Solution"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>