Homepage

Monitor activity log alert is not configured for "Delete Policy Assignment" events Affecting Monitor service in Azure

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Monitoring/ Policy

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-Azure
  • Snyk IDSNYK-CC-00693
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Monitoring for "Delete Policy Assignment" events reduces the time for users to detect any unwanted changes to policy assignments.

How to fix?

Set field operationName to Microsoft.Authorization/policyAssignments/delete and set enabled to true.

Example configuration:

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
  {
    "type": "Microsoft.Insights/activityLogAlerts",
    "apiVersion": "2017-04-01",
    "name": "allowed1",
    "location": "global",
    "properties": {
      "scopes": [
        "[subscription().id]"
      ],
      "condition": {
        "allOf": [
          {
            "field": "category",
            "equals": "Administrative"
          },
          {
            "field": "operationName",
            "equals": "Microsoft.Authorization/policyAssignments/delete"
          }
        ]
      },
      "actions": {
        "actionGroups": []
      },
      "enabled": true
    }
  }
]
}