Skip to main content

Log Profile is not provisioned

More Info:​

Enable Log Profile for exporting activity logs

Risk Level​

Low

Address​

Operational Maturity, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • FedRAMP
  • GDPR
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of a missing Log Profile in Azure using the Azure console, you can follow the below steps:

  1. Log in to the Azure portal using your credentials.

  2. In the Azure portal, navigate to the resource group that has the misconfigured resource.

  3. Select the resource that needs to be remediated.

  4. Under the Monitoring section, select "Diagnostic settings".

  5. In the Diagnostic settings blade, select "Add diagnostic setting".

  6. In the Add diagnostic setting blade, fill in the required details such as the name of the diagnostic setting, the target resource, and the logs that need to be collected.

  7. Under the Destination details section, select the destination where you want to store the logs.

  8. Once you have filled in all the details, click on "Save" to create the diagnostic setting.

  9. After completing the above steps, the Log Profile will be provisioned and the logs will start getting collected.

  10. You can verify the remediation by checking the status of the diagnostic setting in the Monitoring section of the resource.

By following these steps, you can remediate the misconfiguration of a missing Log Profile in Azure using the Azure console.

Using CLI

To remediate the misconfiguration "Log Profile is not provisioned" in Azure using Azure CLI, follow these steps:

  1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.
  2. Login to your Azure account using the command az login.
  3. Once you are logged in, select the appropriate subscription using the command az account set --subscription <subscription_id>.
  4. Check if the log profile exists by running the command az monitor log-profiles show --name <log_profile_name> --resource-group <resource_group_name>. Replace <log_profile_name> with the name of the log profile and <resource_group_name> with the name of the resource group where the log profile is expected to be provisioned.
  5. If the log profile does not exist, create a new one using the command az monitor log-profiles create --name <log_profile_name> --locations <location_name> --categories <category_name> --days <retention_days> --resource-group <resource_group_name>. Replace <log_profile_name> with the name of the new log profile, <location_name> with the location where the log data should be stored, <category_name> with the category of logs to be collected, <retention_days> with the number of days to retain the logs, and <resource_group_name> with the name of the resource group where the log profile should be provisioned.
  6. Once the log profile is created, verify that it exists using the command az monitor log-profiles show --name <log_profile_name> --resource-group <resource_group_name>.
  7. If the log profile already exists, you can update it using the command az monitor log-profiles update --name <log_profile_name> --locations <location_name> --categories <category_name> --days <retention_days> --resource-group <resource_group_name>.
  8. Verify that the log profile has been updated using the command az monitor log-profiles show --name <log_profile_name> --resource-group <resource_group_name>.

By following the above steps, you should be able to remediate the misconfiguration "Log Profile is not provisioned" in Azure using Azure CLI.

Using Python

To remediate the misconfiguration of Log Profile not being provisioned in Azure using Python, you can follow these steps:

  1. Import the necessary libraries:
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import LogProfileResource
from azure.identity import DefaultAzureCredential
  1. Set the necessary variables:
subscription_id = 'your_subscription_id'
resource_group_name = 'your_resource_group_name'
log_profile_name = 'your_log_profile_name'
location = 'your_location'
  1. Authenticate with Azure:
credential = DefaultAzureCredential()
monitor_client = MonitorManagementClient(credential, subscription_id)
  1. Check if the Log Profile already exists:
log_profile = monitor_client.log_profiles.get(resource_group_name, log_profile_name)
  1. If the Log Profile does not exist, create it:
if not log_profile:
    log_profile = LogProfileResource(location=location, categories=["Write", "Delete", "Action"])
    monitor_client.log_profiles.create_or_update(resource_group_name, log_profile_name, log_profile)
  1. If the Log Profile already exists, update it:
else:
    log_profile.categories = ["Write", "Delete", "Action"]
    monitor_client.log_profiles.create_or_update(resource_group_name, log_profile_name, log_profile)
  1. Verify that the Log Profile is provisioned:
log_profile = monitor_client.log_profiles.get(resource_group_name, log_profile_name)
print(log_profile.provisioning_state)

This should remediate the misconfiguration of Log Profile not being provisioned in Azure using Python.

Using Terraform
resource "azurerm_monitor_log_profile" "activity_logs" {
  name = "ACTIVITY_LOG_PROFILE_NAME" # replace with a globally-unique log profile name

  # Locations whose Activity Logs you want to export
  locations = [
    "GLOBAL",
    "WESTUS2",
    "EASTUS",
    # add/remove Azure regions as required
  ]

  # Activity Log categories to capture; adjust as required
  categories = [
    "Write",
    "Delete",
    "Action",
  ]

  # At least one destination is required; this example uses a Storage Account.
  # Replace STORAGE_ACCOUNT_ID with the ID of an azurerm_storage_account resource.
  storage_account_id = azurerm_storage_account.activity_logs.id

  retention_policy {
    enabled = true
    days    = 90 # replace with required retention in days
  }
}

resource "azurerm_storage_account" "activity_logs" {
  name                     = "ACTIVITYLOGSSTORAGE"        # replace with a unique name
  resource_group_name      = "RESOURCE_GROUP_NAME"        # replace with existing RG
  location                 = "AZURE_REGION"               # e.g. "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

This creates the missing Log Profile and begins exporting Azure Activity Logs to the specified Storage Account; it will not replace existing resources unless you later change immutable fields such as the name of the azurerm_monitor_log_profile or azurerm_storage_account.

Verification: terraform plan should show + azurerm_monitor_log_profile.activity_logs (and + azurerm_storage_account.activity_logs if new) with no destructive changes to existing resources.

Additional Reading:​