Severity Framework
Snyk CCSS
Rule category
Monitoring / Network
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-Azure
HIPAA
ISO-27001
NIST-800-53
PCI-DSS
SOC-2
- Snyk ID SNYK-CC-00682
- credit Snyk Research Team
Description
Monitoring for "Delete Network Security Group Rule" events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
How to fix?
Set field operationName
to Microsoft.Network/networkSecurityGroups/securityRules/delete
and set enabled
to true
.
Example Configuration
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Insights/activityLogAlerts",
"apiVersion": "2017-04-01",
"name": "allowed1",
"location": "global",
"properties": {
"scopes": [
"[subscription().id]"
],
"condition": {
"allOf": [
{
"field": "category",
"equals": "Administrative"
},
{
"field": "operationName",
"equals": "Microsoft.Network/networkSecurityGroups/securityRules/delete"
}
]
},
"actions": {
"actionGroups": []
},
"enabled": true
}
}
]
}