Azure Monitor Audit - Security Checks

Checks Performed

• Create Alert for Create or Update Security Solution Events
• Create Alert for Delete Security Solution Events
• Ensure Activity Log Alert exists for Create or Update Network Security Group
• Ensure Activity Log Alert exists for Create or Update Network Security Group Rule
• Ensure Activity Log Alert exists for Create or Update Security Policy
• Ensure Activity Log Alert exists for Create or Update Security Solution
• Ensure Activity Log Alert exists for Create or Update SQL Server Firewall Rule
• Ensure Activity Log Alert exists for Create Policy Assignment
• Ensure Activity Log Alert exists for Delete Network Security Group
• Ensure Activity Log Alert exists for Delete Network Security Group Rule
• Ensure Activity Log Alert exists for Delete Policy Assignment
• Ensure Activity Log Alert exists for Delete Security Policy
• Ensure Activity Log Alert exists for Delete Security Solution
• Ensure Activity Log Alert exists for Delete SQL Server Firewall Rule
• Ensure activity log retention is set for 365 days or greater
• Ensure Diagnostic Setting Captures Appropriate Categories
• Ensure log profile is configured for all regions
• Ensure log profile is configured to export all activities
• Ensure Storage Account container containing the logs is encrypted with BYOK
• Ensure Storage Account container containing the logs is not publicly accessible
• Log Profile is not provisioned
• Setup Alerts for Delete Key Vault Events
• Setup Alerts for Delete Virtual Machine Events
• Setup Alerts for Power Off Virtual Machine Events
• Setup Alerts for Update Key Vault Events
• Setup Alerts for Virtual Machine Events