cis-azure-foundations-6-1-2-6

name	cis-azure-foundations-6.1.2.6
description	Ensure Activity Log Alert exists for Delete Security Solution
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","logging","monitoring","activity-log-alerts","security"]
cis_id	6.1.2.6
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-6.1.2.5"]
prerequisites	[]
severity_boost	{}

Ensure that Activity Log Alert exists for Delete Security Solution

Description

Create an activity log alert for the Delete Security Solution event.

Rationale

Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.

Impact

None identified.

Audit Procedure

Using Azure Portal

1. Navigate to the Monitor blade.
2. Click on Alerts.
3. In the Alerts window, click on Alert rules.
4. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Security/securitySolutions/delete.
5. Click on the Alert Name associated with the previous step.
6. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Security Solutions' and does not filter on Level, Status or Caller.
7. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization.

Using Azure CLI

az monitor activity-log alert list --subscription <subscription Id> --query "[].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions}"

Look for Microsoft.Security/securitySolutions/delete in the output.

Using PowerShell

Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match "Microsoft.Security/securitySolutions/delete"}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf

Expected Result

An activity log alert rule should exist with the operation name Microsoft.Security/securitySolutions/delete and an action group assigned.

Remediation

Remediate from Azure Portal

1. Navigate to the Monitor blade.
2. Select Alerts.
3. Select Create.
4. Select Alert rule.
5. Choose a subscription.
6. Select Apply.