用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-6-1-1-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-azure-foundations-6.1.1.1 |
| description | Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","logging","monitoring","diagnostic-settings","activity-logs"] |
| cis_id | 6.1.1.1 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-6.1.1.2","cis-azure-foundations-6.1.1.3"] |
| prerequisites | [] |
| severity_boost | {} |
Enable Diagnostic settings for exporting activity logs. Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.
A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.
None identified.
To identify Diagnostic Settings on a subscription:
Monitor.Activity Log.Export Activity Logs.Subscription.Diagnostic setting exists for the selected Subscription.To identify Diagnostic Settings on specific resources:
Monitoring.Diagnostic settings.Diagnostic setting exists for all appropriate resources.To identify Diagnostic Settings on a subscription:
az monitor diagnostic-settings subscription list --subscription <subscription-id>
To identify Diagnostic Settings on a resource:
az monitor diagnostic-settings list --resource <resource-id>
To identify Diagnostic Settings on a Subscription:
Get-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription-id>
To identify Diagnostic Settings on a specific resource:
Get-AzDiagnosticSetting -ResourceId <resource-id>
At least one Diagnostic Setting should exist for each subscription, exporting activity logs to a destination such as Log Analytics workspace, Storage Account, or Event Hub.
To enable Diagnostic Settings on a Subscription:
Monitor.Activity log.Export Activity Logs.+ Add diagnostic setting.Diagnostic setting name.Categories for the diagnostic setting.Destination details (Log Analytics, Storage Account, Event Hub, or Partner solution).Save.az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>]> --logs "<JSON encoded categories>" (e.g. [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}])
$logCategories = @();
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ServiceHealth -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Recommendation -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Autoscale -Enabled $true
$logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ResourceHealth -Enabled $true
New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories
No Diagnostic Settings are configured by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit Logs | x | x | |
| v7 | 6.3 Enable Detailed Logging | x | x |
| Techniques | Tactics | Mitigations |
|---|---|---|
| T1485 | TA0040 | M1053 |
Level 1 | Automated