Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs

CaoCấp 1Xem xét thủ côngazure

Mô tả

Enable Diagnostic settings for exporting activity logs. Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment. A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Audit from Azure Portal To identify Diagnostic Settings on a subscription: 1. Go to Monitor 2. Click Activity Log 3. Click Export Activity Logs 4. Select a Subscription 5. Ensure a Diagnostic setting exists for the selected Subscription To identify Diagnostic Settings on specific resources: 1. Go to Monitoring 2. Click Diagnostic settings 3. Ensure a Diagnostic setting exists for all appropriate resources. Audit from Azure CLI To identify Diagnostic Settings on a subscription: az monitor diagnostic-settings subscription list --subscription <subscription-id> To identify Diagnostic Settings on a resource az monitor diagnostic-settings list --resource <resource-id> Audit from PowerShell To identify Diagnostic Settings on a Subscription: Get-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription-id> To identify Diagnostic Settings on a specific resource: Get-AzDiagnosticSetting -ResourceId <resource-id>

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Remediate from Azure Portal To enable Diagnostic Settings on a Subscription: 1. Go to Monitor 2. Click on Activity log 3. Click on Export Activity Logs 4. Click + Add diagnostic setting 5. Enter a Diagnostic setting name 6. Select Categories for the diagnostic setting 7. Select the appropriate Destination details (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 8. Click Save To enable Diagnostic Settings on a specific resource: 1. Go to Monitoring 2. Click Diagnostic settings 3. Select Add diagnostic setting 4. Enter a Diagnostic setting name 5. Select the appropriate log, metric, and destination (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 6. Click Save Repeat these step for all resources as needed. Remediate from Azure CLI To configure Diagnostic Settings on a Subscription: az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[- -event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [-- storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs "<JSON encoded categories>" (e.g. [{cate...

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: azurecloudlogging
Tham chiếu: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 6.1.1.1 Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs