Azure Audit Monitor Alerts For Vm Delete Events Remediation

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate misconfiguration of not having alerts set up for delete virtual machine events in Azure:

Login to Azure portal using your credentials.
Navigate to the "Virtual Machines" blade from the left-hand side menu.
Select the virtual machine for which you want to set up alerts for delete events.
Under the "Monitoring" section, select "Alerts" and click on the "New alert rule" button.
In the "New alert rule" page, select the "Signal logic" tab.
In the "Signal logic" tab, select "Virtual machines" from the "Resource type" drop-down menu.
Select "Delete" from the "Signal name" drop-down menu.
Set the "Aggregation type" to "Count".
Set the "Threshold value" to "1".
Set the "Evaluation frequency" to "5 minutes".
In the "Actions" tab, select "Add action group".
In the "Add action group" page, click on the "Create action group" button.
In the "Create action group" page, provide a name for the action group.
Select "Email/SMS/Push/Voice" as the "Action type".
Enter the email address or phone number in the "Email/SMS/Push/Voice details" field.
Click on the "OK" button to create the action group.
Select the newly created action group from the "Actions" tab.
Click on the "Create alert rule" button to save the alert rule.

With these steps, you have successfully remediated the misconfiguration of not having alerts set up for delete virtual machine events in Azure. Now, you will receive an email or SMS notification whenever a virtual machine is deleted in your Azure environment.

Using CLI

To remediate the misconfiguration "Setup Alerts for Delete Virtual Machine Events" in AZURE using AZURE CLI, follow these steps:

Open the AZURE CLI on your system.
Run the following command to create a new action group for the alerts:
```
az monitor action-group create --name <action-group-name> --short-name <short-name> --email <email-address> --sms <phone-number>
```
Replace <action-group-name> with a name for the action group, <short-name> with a short name for the action group, <email-address> with the email address to receive alerts, and <phone-number> with the phone number to receive alerts.
Run the following command to create a new alert rule:
```
az monitor metrics alert create --name <alert-rule-name> --description <description> --resource <resource-id> --metric "Percentage CPU" --operator GreaterThan --threshold 90 --time-aggregation Average --evaluation-frequency 5 --actions <action-group-name>
```
Replace <alert-rule-name> with a name for the alert rule, <description> with a description for the alert rule, <resource-id> with the ID of the resource to monitor (e.g. virtual machine), and <action-group-name> with the name of the action group created in step 2.
Run the following command to verify the alert rule:
```
az monitor metrics alert show --name <alert-rule-name> --resource <resource-id>
```
Replace <alert-rule-name> with the name of the alert rule created in step 3 and <resource-id> with the ID of the resource to monitor.

With these steps, you have successfully set up alerts for delete virtual machine events in AZURE using AZURE CLI.

Using Python

To remediate the misconfiguration of not having alerts set up for delete virtual machine events in Azure, you can follow these steps using Python:

Install the Azure SDK for Python using the following command:
```
pip install azure-mgmt-monitor
```
Authenticate to your Azure account using the Azure CLI or by providing a Service Principal.

Create a new alert rule using the azure-mgmt-monitor package. The following code snippet demonstrates how to create an alert rule for delete virtual machine events:

from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import (AlertRuleResource, Condition, 
                                        RuleMetricDataSource, RuleMetricDimension)

# Replace with your own values
RESOURCE_GROUP_NAME = 'my-resource-group'
VM_NAME = 'my-vm'
ALERT_NAME = 'vm-delete-alert'
ACTION_GROUP_ID = '/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/microsoft.insights/actionGroups/<action-group-name>'

# Create the rule condition
condition = Condition(
    metric_name='SuccessfulCalls',
    metric_namespace='Microsoft.Compute/virtualMachines',
    operator='==',
    threshold='0',
    time_aggregation='Total',
    dimensions=[
        RuleMetricDimension(name='ResourceId', value=f"/subscriptions/<subscription-id>/resourceGroups/{RESOURCE_GROUP_NAME}/providers/Microsoft.Compute/virtualMachines/{VM_NAME}")
    ]
)

# Create the rule data source
data_source = RuleMetricDataSource(
    resource_uri=f"/subscriptions/<subscription-id>/resourceGroups/{RESOURCE_GROUP_NAME}/providers/Microsoft.Compute/virtualMachines/{VM_NAME}",
    metric_name='SuccessfulCalls',
    metric_namespace='Microsoft.Compute/virtualMachines'
)

# Create the alert rule
alert_rule = AlertRuleResource(
    name=ALERT_NAME,
    description='Alert for virtual machine delete events',
    is_enabled=True,
    condition=condition,
    actions=[
        {
            'action_group_id': ACTION_GROUP_ID
        }
    ],
    data_source=data_source
)

# Create the MonitorManagementClient and create the alert rule
monitor_client = MonitorManagementClient(credentials, subscription_id)
monitor_client.alert_rules.create_or_update(
    RESOURCE_GROUP_NAME,
    ALERT_NAME,
    alert_rule
)

Replace the placeholders in the code snippet with your own values, such as the resource group name, virtual machine name, alert name, and action group ID.
Run the Python script to create the alert rule.

With these steps, you should have successfully remediated the misconfiguration of not having alerts set up for delete virtual machine events in Azure.

Using Terraform

resource "azurerm_monitor_action_group" "VM_DELETE_ALERT_ACTION_GROUP" {
  name                = "vm-delete-alert-ag"
  resource_group_name = "RESOURCE_GROUP_NAME"     # replace with the resource group for the action group
  short_name          = "vmDelAG"

  email_receiver {
    name                    = "vm-delete-email"
    email_address           = "ALERT_EMAIL_ADDRESS"   # replace with destination email
    use_common_alert_schema = true
  }

  # Add other receivers (sms_receiver, webhook_receiver, etc.) as needed
}

resource "azurerm_monitor_activity_log_alert" "VM_DELETE_ACTIVITY_LOG_ALERT" {
  name                = "vm-delete-activity-log-alert"
  resource_group_name = "RESOURCE_GROUP_NAME"     # replace with the resource group for the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"]  # replace with your subscription ID, or specific resource group/resource IDs
  description         = "Alert on Delete Virtual Machine (Microsoft.Compute/virtualMachines/delete) events"

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Compute/virtualMachines/delete"
    # Any level, any status, any caller -> do not set level, status, or caller here
  }

  action {
    action_group_id = azurerm_monitor_action_group.VM_DELETE_ALERT_ACTION_GROUP.id
  }

  tags = {
    Environment = "ENVIRONMENT_TAG"  # optional: replace or remove
  }
}

This change is additive and does not force replacement of existing virtual machines or other resources; it only creates/updates the alert and action group.

After updating your Terraform, terraform plan should show one new azurerm_monitor_activity_log_alert and one new azurerm_monitor_action_group being created (or updates to their properties if they already exist).

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation