Severity Framework
Snyk CCSS
Rule category
Monitoring / Settings
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-Azure
HIPAA
ISO-27001
PCI-DSS
- Snyk ID SNYK-CC-00683
- credit Snyk Research Team
Description
Monitoring for "Create or Update Security Solution" events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.
How to fix?
Set field operationName
to Microsoft.Security/securitySolutions/write
and set enabled
to true
.
Example Configuration
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Insights/activityLogAlerts",
"apiVersion": "2017-04-01",
"name": "allowed1",
"location": "global",
"properties": {
"scopes": [
"[subscription().id]"
],
"condition": {
"allOf": [
{
"field": "category",
"equals": "Administrative"
},
{
"field": "operationName",
"equals": "Microsoft.Security/securitySolutions/write"
}
]
},
"actions": {
"actionGroups": []
},
"enabled": true
}
}
]
}