Menu
Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-6-1-1-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-foundations-6.1.1.1 |
| description | Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","logging","monitoring","diagnostic-settings","activity-logs"] |
| cis_id | 6.1.1.1 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-6.1.1.2","cis-azure-foundations-6.1.1.3"] |
| prerequisites | [] |
| severity_boost | {} |
Enable Diagnostic settings for exporting activity logs. Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.
A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.
None identified.
To identify Diagnostic Settings on a subscription:
Monitor.Activity Log.Export Activity Logs.Subscription.Diagnostic setting exists for the selected Subscription.To identify Diagnostic Settings on specific resources:
Monitoring.Diagnostic settings.Diagnostic setting exists for all appropriate resources.To identify Diagnostic Settings on a subscription:
az monitor diagnostic-settings subscription list --subscription <subscription-id>
To identify Diagnostic Settings on a resource:
az monitor diagnostic-settings list --resource <resource-id>
To identify Diagnostic Settings on a Subscription:
Get-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription-id>
To identify Diagnostic Settings on a specific resource:
Get-AzDiagnosticSetting -ResourceId <resource-id>
At least one Diagnostic Setting should exist for each subscription, exporting activity logs to a destination such as Log Analytics workspace, Storage Account, or Event Hub.
To enable Diagnostic Settings on a Subscription:
Monitor.Activity log.Export Activity Logs.+ Add diagnostic setting.Diagnostic setting name.Categories for the diagnostic setting.Destination details (Log Analytics, Storage Account, Event Hub, or Partner solution).Save.az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>]> --logs "<JSON encoded categories>" (e.g. [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}])
$logCategories = @();
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ServiceHealth -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Recommendation -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Autoscale -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ResourceHealth -Enabled $true
New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories
No Diagnostic Settings are configured by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit Logs | x | x | |
| v7 | 6.3 Enable Detailed Logging | x | x |
| Techniques | Tactics | Mitigations |
|---|---|---|
| T1485 | TA0040 | M1053 |
Level 1 | Automated