Skip to main content

​
More Info:

Ensure that a Microsoft Azure activity log alert is fired whenever Update Key Vault event is triggered inside your Microsoft Azure cloud account.

​
Risk Level

High

​
Address

Security

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration “Setup Alerts for Update Key Vault Events” in Azure using Azure console:
  1. Log in to the Azure portal (https://portal.azure.com/).
  2. Navigate to the Key Vault service by selecting “All services” from the left-hand menu, searching for “Key Vault”, and selecting it.
  3. Select the Key Vault that you want to set up alerts for.
  4. Click on “Diagnostic settings” from the left-hand menu.
  5. Click on “Add diagnostic setting”.
  6. Provide a name for your diagnostic setting.
  7. In the “Event Hub” section, select “Send to Log Analytics” and choose the Log Analytics workspace where you want to send the logs.
  8. In the “Logs” section, select “Key Vault”, and then select the “Update” operation.
  9. In the “Metrics” section, select “Key Vault”, and then select the “Total Requests” metric.
  10. Click on “Save” to save the diagnostic setting.
  11. Next, navigate to the Log Analytics workspace where you are sending the logs.
  12. Click on “Alerts” from the left-hand menu.
  13. Click on “New alert rule”.
  14. Provide a name and description for your alert rule.
  15. In the “Condition” section, select “Custom log search”.
  16. In the “Search query” box, enter the following query: 
AzureDiagnostics
| where Category == "KeyVault"
| where OperationName == "Microsoft.KeyVault/vaults/write"
  1. In the “Alert logic” section, set the threshold for the number of events that trigger the alert.
  2. In the “Action groups” section, select the action group that you want to use to notify you of the alert.
  3. Click on “Create alert rule” to create the alert.
That’s it! You have now set up alerts for update Key Vault events in Azure. If any updates are made to the Key Vault, you will receive a notification via your selected action group.

​

To remediate the misconfiguration of setting up alerts for update key vault events in AZURE using AZURE CLI, you can follow the below steps:Step 1: Open the AZURE CLI and login to your AZURE account using the command below:
az login
Step 2: Once you are logged in to your AZURE account, you need to identify the resource group and key vault for which you want to set up alerts. You can use the below command to list all the resource groups in your account:
az group list
Step 3: Once you have identified the resource group, you can use the below command to list all the key vaults in that resource group:
az keyvault list --resource-group <resource-group-name>
Step 4: Once you have identified the key vault, you can use the below command to set up alerts for update key vault events:
az monitor metrics alert create --name <alert-name> --description <alert-description> --resource <key-vault-id> --condition "category=UpdateOperations" --action <action-group-id>
In the above command, you need to replace the placeholders with the actual values:
  • <alert-name>: The name of the alert that you want to create.
  • <alert-description>: The description of the alert that you want to create.
  • <key-vault-id>: The ID of the key vault for which you want to set up alerts.
  • <action-group-id>: The ID of the action group that you want to associate with the alert.
Step 5: Once you have executed the above command, the alert will be created successfully and you will receive notifications for update key vault events.Note: Before executing the above command, make sure that you have created an action group and have the required permissions to create alerts.
To remediate the misconfiguration “Setup Alerts for Update Key Vault Events” in Azure using Python, you can follow the below steps:
  1. Import the necessary libraries and authenticate to Azure using the Azure SDK for Python.
from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.resource import ResourceManagementClient

credential = DefaultAzureCredential()
monitor_client = MonitorManagementClient(
    credential=credential,
    subscription_id='<subscription_id>'
)
resource_client = ResourceManagementClient(
    credential=credential,
    subscription_id='<subscription_id>'
)
  1. Create a new alert rule for Key Vault update events using the monitor_client.alert_rules.create_or_update method.
alert_rule_name = 'keyvault-update-alert'
alert_rule = {
    "location": "global",
    "tags": {
        "owner": "IT",
        "status": "active"
    },
    "name": alert_rule_name,
    "description": "Alert on Key Vault update events",
    "type": "Microsoft.Insights/activityLogAlerts",
    "condition": {
        "allOf": [
            {
                "field": "category",
                "equals": "Administrative"
            },
            {
                "field": "resourceType",
                "equals": "Microsoft.KeyVault/vaults"
            },
            {
                "field": "operationName",
                "equals": "Microsoft.KeyVault/vaults/write"
            }
        ]
    },
    "actions": {
        "actionGroups": [
            {
                "actionGroupId": "<action_group_id>"
            }
        ]
    }
}

monitor_client.alert_rules.create_or_update(
    resource_group_name='<resource_group_name>',
    rule_name=alert_rule_name,
    parameters=alert_rule
)
  1. Verify that the alert rule was created successfully using the monitor_client.alert_rules.get method.
alert_rule = monitor_client.alert_rules.get(
    resource_group_name='<resource_group_name>',
    rule_name=alert_rule_name
)

print(alert_rule)
That’s it! You have now remediated the misconfiguration “Setup Alerts for Update Key Vault Events” in Azure using Python.

​
Additional Reading: