cis-azure-foundations-6-1-1-2

name	cis-azure-foundations-6.1.1.2
description	Ensure Diagnostic Setting captures appropriate categories
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","logging","monitoring","diagnostic-settings","activity-logs"]
cis_id	6.1.1.2
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-6.1.1.1"]
prerequisites	["cis-azure-foundations-6.1.1.1"]
severity_boost	{}

Ensure Diagnostic Setting captures appropriate categories

Description

Prerequisite: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available.

The diagnostic setting should be configured to log the appropriate activities from the control/management plane.

Rationale

A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.

Impact

None identified.

Audit Procedure

Using Azure Portal

1. Go to Monitor.
2. Click Activity log.
3. Click on Export Activity Logs.
4. Select the appropriate Subscription.
5. Click Edit setting next to a diagnostic setting.
6. Ensure that the following categories are checked: Administrative, Alert, Policy, and Security.

Using Azure CLI

Ensure the categories 'Administrative', 'Alert', 'Policy', and 'Security' set to: 'enabled: true'

az monitor diagnostic-settings subscription list --subscription <subscription ID>

Using PowerShell

Ensure the categories Administrative, Alert, Policy, and Security are set to Enabled:True

Get-AzSubscriptionDiagnosticSetting -Subscription <subscriptionID>

Expected Result

The Diagnostic Setting should have the categories Administrative, Alert, Policy, and Security all enabled.

Remediation

Remediate from Azure Portal

1. Go to Monitor.
2. Click Activity log.
3. Click on Export Activity Logs.
4. Select the Subscription from the drop down menu.
5. Click Edit setting next to a diagnostic setting.
6. Check the following categories: Administrative, Alert, Policy, and Security.