Setup Alerts for Virtual Machine Events

More Info:

Ensure that an Azure activity log alert is fired whenever Create Virtual Machine or Update Virtual Machine events are triggered in your Microsoft Azure cloud account. Activity log alerts get triggered when a new activity log event that matches the condition specified in the alert configuration occurs. The matched condition is Whenever the Administrative Activity Log Create or Update Virtual Machine (Microsoft.Compute/virtualMachines) has any level, with any status and event is initiated by any

Risk Level

Informational

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration "Setup Alerts for Virtual Machine Events" in Azure using the Azure console:

1. Log in to the Azure portal (https://portal.azure.com/).
2. Navigate to the "Virtual machines" section.
3. Select the virtual machine for which you want to set up alerts.
4. In the left-hand menu, click on "Alerts".
5. Click on the "New alert rule" button.
6. In the "Basics" tab, give a name for the alert rule.
7. In the "Condition" tab, select "Virtual machine" under "Resource type".
8. Under "Condition", select the event type you want to set up an alert for. For example, you can select "VM deallocated" to get an alert when the virtual machine is deallocated.
9. Under "Additional condition", you can set up additional conditions for the alert rule if required.
10. In the "Actions" tab, select "Email/SMS/Push/Voice" under "Action group". If you haven't set up an action group yet, you can create a new one by clicking on "New action group".
11. In the "Notifications" tab, add the email addresses or phone numbers of the recipients who should receive the alerts.
12. Click on the "Create alert rule" button to create the alert rule.

By following these steps, you should be able to successfully remediate the misconfiguration "Setup Alerts for Virtual Machine Events" in Azure using the Azure console.

Using CLI

To remediate the misconfiguration "Setup Alerts for Virtual Machine Events" in Azure using Azure CLI, you can follow the below steps:

1. Open Azure CLI and login to your Azure account using the command az login

2. Set the default subscription that you want to work with using the command az account set --subscription <subscription_id>

3. Create a new action group to define the actions to be taken when an alert is triggered using the command az monitor action-group create --name <action_group_name> --short-name <short_name> --email <email_address> --sms <phone_number>

   Note: Replace <action_group_name>, <short_name>, <email_address> and <phone_number> with your desired values.

4. Create a new alert rule that will trigger an alert when a virtual machine event occurs using the command az monitor metrics alert create --name <alert_rule_name> --description <description> --resource-group <resource_group_name> --scopes <vm_resource_id> --condition "category=ServiceHealth and resourceName=<vm_name>" --action <action_group_name>

   Note: Replace <alert_rule_name>, <description>, <resource_group_name>, <vm_resource_id>, <vm_name> and <action_group_name> with your desired values.

5. Verify the alert rule by running the command az monitor metrics alert show --name <alert_rule_name> --resource-group <resource_group_name>

   Note: Replace <alert_rule_name> and <resource_group_name> with your desired values.

By following these steps, you will be able to remediate the misconfiguration "Setup Alerts for Virtual Machine Events" in Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Setup Alerts for Virtual Machine Events" in Azure using Python, you can follow the below steps:

Step 1: Install the Azure SDK for Python using pip command.

pip install azure-mgmt-compute

Step 2: Create an Azure AD application and service principal. This can be done using the Azure portal or Azure CLI.

Step 3: Authenticate the application and service principal using the below code snippet.

from azure.common.credentials import ServicePrincipalCredentials

TENANT_ID = '<tenant_id>'
CLIENT_ID = '<client_id>'
CLIENT_SECRET = '<client_secret>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

Step 4: Use the Azure SDK for Python to create an alert rule for virtual machine events. The below code snippet creates an alert rule for virtual machine start and stop events.

from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import *

SUBSCRIPTION_ID = '<subscription_id>'
RESOURCE_GROUP_NAME = '<resource_group_name>'
VM_NAME = '<vm_name>'

monitor_client = MonitorManagementClient(credentials, SUBSCRIPTION_ID)

condition = AlertRuleAllOfCondition(
    all_of=[
        AlertRuleLeafCondition(
            field='category',
            equals='Administrative'
        ),
        AlertRuleLeafCondition(
            field='resourceId',
            contains=VM_NAME
        ),
        AlertRuleLeafCondition(
            field='operationName',
            equals='Microsoft.Compute/virtualMachines/start/action'
        ),
        AlertRuleLeafCondition(
            field='operationName',
            equals='Microsoft.Compute/virtualMachines/deallocate/action'
        )
    ]
)

actions = AlertRuleActionList(
    action_groups=[
        '/subscriptions/{}/resourceGroups/{}/providers/microsoft.insights/actionGroups/<action_group_name>'.format(SUBSCRIPTION_ID, RESOURCE_GROUP_NAME)
    ]
)

alert_rule = AlertRule(
    location='global',
    condition=condition,
    actions=actions,
    description='Alert for virtual machine start and stop events'
)

monitor_client.alert_rules.create_or_update(
    RESOURCE_GROUP_NAME,
    'vm-start-stop-alert',
    alert_rule
)

Step 5: The above code snippet will create an alert rule for virtual machine start and stop events. You can modify the code to create alert rules for other events as well.

Note: Replace the placeholders <tenant_id>, <client_id>, <client_secret>, <subscription_id>, <resource_group_name>, <vm_name> and <action_group_name> with actual values.

Using Terraform

# Replace these with your actual values:
# - AZURE_RESOURCE_GROUP_NAME: Resource group where the alert definition will live
# - AZURE_LOCATION: Azure region for the action group
# - ACTION_GROUP_NAME: Name for the action group
# - ALERT_RULE_NAME: Name for the activity log alert
# - SUBSCRIPTION_ID: Subscription to monitor (or use a data source instead)

provider "azurerm" {
  features {}
}

# Optional: data source to resolve current subscription scope
data "azurerm_subscription" "current" {}

resource "azurerm_monitor_action_group" "vm_events" {
  name                = "ACTION_GROUP_NAME"
  resource_group_name = "AZURE_RESOURCE_GROUP_NAME"
  short_name          = "vm-evt"
  location            = "AZURE_LOCATION"

  # Example email receiver (adjust/remove as needed)
  email_receiver {
    name          = "primary-email"
    email_address = "ALERT_RECIPIENT_EMAIL"
  }
}

resource "azurerm_monitor_activity_log_alert" "vm_create_update" {
  name                = "ALERT_RULE_NAME"
  resource_group_name = "AZURE_RESOURCE_GROUP_NAME"

  # Monitor the whole subscription; you can also hardcode
  # ["SUBSCRIPTIONS/SUBSCRIPTION_ID"] instead of using the data source.
  scopes = [
    data "azurerm_subscription" "current".id
  ]

  description = "Alert when Virtual Machines are created or updated"
  enabled     = true

  criteria {
    # Activity log category for control-plane operations
    category = "Administrative"

    # Match create/update VM operations; this corresponds to:
    # "Create Virtual Machine" / "Update Virtual Machine"
    operation_name = "Microsoft.Compute/virtualMachines/write"

    # Leaving level, status, and caller unconstrained matches:
    # "any level, any status, any caller"
  }

  action {
    action_group_id = azurerm_monitor_action_group.vm_events.id
  }
}

This change does not force replacement of any existing VMs; it only creates/updates monitoring resources. After you add this, terraform plan should show creation of one azurerm_monitor_action_group and one azurerm_monitor_activity_log_alert (or modifications if they already exist but differ).

Additional Reading:

• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log
• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-log