Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Audit from Azure Portal To identify Diagnostic Settings on a subscription: 1. Go to Monitor 2. Click Activity Log 3. Click Export Activity Logs 4. Select a Subscription 5. Ensure a Diagnostic setting exists for the selected Subscription To identify Diagnostic Settings on specific resources: 1. Go to Monitoring 2. Click Diagnostic settings 3. Ensure a Diagnostic setting exists for all appropriate resources. Audit from Azure CLI To identify Diagnostic Settings on a subscription: az monitor diagnostic-settings subscription list --subscription <subscription-id> To identify Diagnostic Settings on a resource az monitor diagnostic-settings list --resource <resource-id> Audit from PowerShell To identify Diagnostic Settings on a Subscription: Get-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription-id> To identify Diagnostic Settings on a specific resource: Get-AzDiagnosticSetting -ResourceId <resource-id>

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Remediate from Azure Portal To enable Diagnostic Settings on a Subscription: 1. Go to Monitor 2. Click on Activity log 3. Click on Export Activity Logs 4. Click + Add diagnostic setting 5. Enter a Diagnostic setting name 6. Select Categories for the diagnostic setting 7. Select the appropriate Destination details (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 8. Click Save To enable Diagnostic Settings on a specific resource: 1. Go to Monitoring 2. Click Diagnostic settings 3. Select Add diagnostic setting 4. Enter a Diagnostic setting name 5. Select the appropriate log, metric, and destination (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 6. Click Save Repeat these step for all resources as needed. Remediate from Azure CLI To configure Diagnostic Settings on a Subscription: az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[- -event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [-- storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs "<JSON encoded categories>" (e.g. [{cate...