cis-azure-foundations-6-1-2-8

name	cis-azure-foundations-6.1.2.8
description	Ensure Activity Log Alert exists for Delete SQL Server Firewall Rule
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","logging","monitoring","activity-log-alerts","sql","firewall"]
cis_id	6.1.2.8
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-6.1.2.7"]
prerequisites	[]
severity_boost	{}

Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule

Description

Create an activity log alert for the "Delete SQL Server Firewall Rule."

Rationale

Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.

Impact

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Audit Procedure

Using Azure Portal

1. Navigate to the Monitor blade.
2. Click on Alerts.
3. In the Alerts window, click on Alert rules.
4. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Sql/servers/firewallRules/delete.
5. Click on the Alert Name associated with the previous step.
6. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete server firewall rule' and does not filter on Level, Status or Caller.
7. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization.

Using Azure CLI

az monitor activity-log alert list --subscription <subscription ID> --query "[].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions}"

Look for Microsoft.Sql/servers/firewallRules/delete in the output.

Using PowerShell

Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match "Microsoft.Sql/servers/firewallRules/delete"}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf

Expected Result

An activity log alert rule should exist with the operation name Microsoft.Sql/servers/firewallRules/delete and an action group assigned.

Remediation

Remediate from Azure Portal

1. Navigate to the Monitor blade.
2. Select Alerts.
3. Select Create.
4. Select Alert rule.