Unable to make the policy "An activity log alert should exist for specific administrative operations" compliance

Question

Hello All,

We have applied Azure CIS Azure Foundations v2.1.0 Regulatory Compliance on our subscription. Some of the policy among the initiative is not getting compliance, Below is the initiative for the NSG.

I have created alert for the NSG creation & updation and it was compliance, but unable to find solution for the policy "an activity log alert should exist for specific administrative operations"

Need help on this.

Regards,

Fahim

Answer 1

Hi,

That policy has input parameter name operationName. So you should check first which of these operations were configured by the policy to check:

    "Microsoft.Sql/servers/firewallRules/write",
    "Microsoft.Sql/servers/firewallRules/delete",
    "Microsoft.Network/networkSecurityGroups/write",
    "Microsoft.Network/networkSecurityGroups/delete",
    "Microsoft.ClassicNetwork/networkSecurityGroups/write",
    "Microsoft.ClassicNetwork/networkSecurityGroups/delete",
    "Microsoft.Network/networkSecurityGroups/securityRules/write",
    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
    "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write",
    "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/delete"

After that you should configure activity log alert with conditions that it applies for Administrative category and operation name for example Microsoft.Network/networkSecurityGroups/delete. Note that when you configure the alert via portal these operation names has display names instead of the raw type if you hover the mouse over the display name you will see the type. For example, type Microsoft.Network/networkSecurityGroups/delete has display name "Delete Network Security Group (Network Security Group)". In case you have one or more policies assigned with different input for operatioName you will need to create alert rule for each operation. Also keep in mind that if the policy is assigned to more than one subscription you should create such alert rule for each subscription.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.