An activity log alert should exist for specific Security operations : Wrong category in the rules sec

Question

Hello Team,

I Have assigned policy CIS Microsoft Azure Foundations Benchmark v2.0.0 to my subscription. I have created alerts for the required policy but still it showing non compliance.

Upon further researching it seems there is some bug in the Policy definition.

I have created alert as shown in attachment with category as "Administrative"

but the policy definition says category should be "Security" (see policy definition attachment.

so there is discrepancy in the policy defintion and that particular singal is unavailable in the Security category

so please look into it.

Regards,

Fahim

Answer 1

Hi @Fahim Thanawala

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Change the alert's category to "Security" to match the policy. That should get the alert working correctly.

If the alert still doesn’t trigger after changing the category, it's possible that the signal isn’t showing up under "Security". You might want to double-check if it's logged under "Administrative" or another category.

If you have any concerns, please go through this link: -

https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-insights/alert-policy-and-its-configuration

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request

If you have any further queries, do let us know

---

If the answer is helpful, please click "Accept Answer" and "Upvote it"