Azure Audit Monitor Alerts For Keyvault Create Update Fix

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration "Setup Alerts for Update Key Vault Events" in Azure using Azure console:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the Key Vault service by selecting "All services" from the left-hand menu, searching for "Key Vault", and selecting it.
Select the Key Vault that you want to set up alerts for.
Click on "Diagnostic settings" from the left-hand menu.
Click on "Add diagnostic setting".
Provide a name for your diagnostic setting.
In the "Event Hub" section, select "Send to Log Analytics" and choose the Log Analytics workspace where you want to send the logs.
In the "Logs" section, select "Key Vault", and then select the "Update" operation.
In the "Metrics" section, select "Key Vault", and then select the "Total Requests" metric.
Click on "Save" to save the diagnostic setting.
Next, navigate to the Log Analytics workspace where you are sending the logs.
Click on "Alerts" from the left-hand menu.
Click on "New alert rule".
Provide a name and description for your alert rule.
In the "Condition" section, select "Custom log search".
In the "Search query" box, enter the following query:

AzureDiagnostics
| where Category == "KeyVault"
| where OperationName == "Microsoft.KeyVault/vaults/write"

In the "Alert logic" section, set the threshold for the number of events that trigger the alert.
In the "Action groups" section, select the action group that you want to use to notify you of the alert.
Click on "Create alert rule" to create the alert.

That's it! You have now set up alerts for update Key Vault events in Azure. If any updates are made to the Key Vault, you will receive a notification via your selected action group.

Using CLI

To remediate the misconfiguration of setting up alerts for update key vault events in AZURE using AZURE CLI, you can follow the below steps:

Step 1: Open the AZURE CLI and login to your AZURE account using the command below:

az login

Step 2: Once you are logged in to your AZURE account, you need to identify the resource group and key vault for which you want to set up alerts. You can use the below command to list all the resource groups in your account:

az group list

Step 3: Once you have identified the resource group, you can use the below command to list all the key vaults in that resource group:

az keyvault list --resource-group <resource-group-name>

Step 4: Once you have identified the key vault, you can use the below command to set up alerts for update key vault events:

az monitor metrics alert create --name <alert-name> --description <alert-description> --resource <key-vault-id> --condition "category=UpdateOperations" --action <action-group-id>

In the above command, you need to replace the placeholders with the actual values:

<alert-name>: The name of the alert that you want to create.
<alert-description>: The description of the alert that you want to create.
<key-vault-id>: The ID of the key vault for which you want to set up alerts.
<action-group-id>: The ID of the action group that you want to associate with the alert.

Step 5: Once you have executed the above command, the alert will be created successfully and you will receive notifications for update key vault events.

Note: Before executing the above command, make sure that you have created an action group and have the required permissions to create alerts.

Using Python

To remediate the misconfiguration "Setup Alerts for Update Key Vault Events" in Azure using Python, you can follow the below steps:

Import the necessary libraries and authenticate to Azure using the Azure SDK for Python.

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.resource import ResourceManagementClient

credential = DefaultAzureCredential()
monitor_client = MonitorManagementClient(
    credential=credential,
    subscription_id='<subscription_id>'
)
resource_client = ResourceManagementClient(
    credential=credential,
    subscription_id='<subscription_id>'
)

Create a new alert rule for Key Vault update events using the monitor_client.alert_rules.create_or_update method.

alert_rule_name = 'keyvault-update-alert'
alert_rule = {
    "location": "global",
    "tags": {
        "owner": "IT",
        "status": "active"
    },
    "name": alert_rule_name,
    "description": "Alert on Key Vault update events",
    "type": "Microsoft.Insights/activityLogAlerts",
    "condition": {
        "allOf": [
            {
                "field": "category",
                "equals": "Administrative"
            },
            {
                "field": "resourceType",
                "equals": "Microsoft.KeyVault/vaults"
            },
            {
                "field": "operationName",
                "equals": "Microsoft.KeyVault/vaults/write"
            }
        ]
    },
    "actions": {
        "actionGroups": [
            {
                "actionGroupId": "<action_group_id>"
            }
        ]
    }
}

monitor_client.alert_rules.create_or_update(
    resource_group_name='<resource_group_name>',
    rule_name=alert_rule_name,
    parameters=alert_rule
)

Verify that the alert rule was created successfully using the monitor_client.alert_rules.get method.

alert_rule = monitor_client.alert_rules.get(
    resource_group_name='<resource_group_name>',
    rule_name=alert_rule_name
)

print(alert_rule)

That's it! You have now remediated the misconfiguration "Setup Alerts for Update Key Vault Events" in Azure using Python.

Using Terraform

resource "azurerm_monitor_activity_log_alert" "update_key_vault" {
  name                = "update-key-vault-activity-alert"
  resource_group_name = "RESOURCE_GROUP_NAME"          # replace with the resource group for the alert rule
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"]  # replace with your subscription ID
  description         = "Alert when Azure Key Vault is updated"
  enabled             = true

  # Fire when an Update operation is performed on a Key Vault
  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.KeyVault/vaults/write"
  }

  action {
    action_group_id = "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP_NAME/providers/microsoft.insights/actionGroups/ACTION_GROUP_NAME"
    # replace SUBSCRIPTION_ID, RESOURCE_GROUP_NAME and ACTION_GROUP_NAME with your action group details
  }

  tags = {
    Environment = "ENVIRONMENT_TAG" # optional, replace or remove as needed
  }
}

This change does not force replacement of any existing Key Vaults; it only creates/updates the Azure Monitor Activity Log Alert resource itself.

To verify, terraform plan should show creation (or update) of azurerm_monitor_activity_log_alert.update_key_vault with criteria.category = "Administrative" and criteria.operation_name = "Microsoft.KeyVault/vaults/write", and the correct action_group_id attached.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation