Azure Audit Monitor Log Profiles Without All Regions Fix

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Ensure log profile is configured for all regions" for Azure using the Azure console, you can follow the below steps:

1. Log in to the Azure portal using your credentials.
2. From the left-hand side menu, select "Log Analytics workspaces".
3. Select the workspace you want to configure for all regions.
4. Click on "Advanced settings" under the "Settings" section of the left-hand side menu.
5. Under "Data", select "Log profiles".
6. Click on "Add" to create a new log profile.
7. In the "Add log profile" window, enter a name for the log profile.
8. Under the "Regions" section, select "All regions".
9. Under the "Categories" section, select the categories of logs you want to collect.
10. Under the "Destination" section, select the destination where you want to send the logs.
11. Click on "OK" to save the log profile.

By following these steps, you will remediate the misconfiguration "Ensure log profile is configured for all regions" for Azure using the Azure console.

Using CLI

To remediate the misconfiguration "Ensure log profile is configured for all regions" for AZURE using AZURE CLI, you can follow the below steps:

Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell.

Step 2: Run the following command to list all the available regions in your AZURE subscription:

az account list-locations --query [*].name

Step 3: Run the following command to create a log profile for each region:

for region in $(az account list-locations --query [*].name -o tsv); do az monitor log-profiles create --locations $region --categories Write --enabled true --days 30 --name default; done

This command will create a log profile named "default" for each region and enable it for 30 days.

Step 4: Verify that the log profiles have been created for all regions by running the following command:

az monitor log-profiles list --query [*].locations

This command will list all the locations where the log profiles have been created.

Step 5: Finally, you can validate the remediation by ensuring that the log profiles are configured for all regions.

Using Python

To remediate the misconfiguration "Ensure log profile is configured for all regions" in Azure using Python, follow these steps:

1. Import the necessary libraries:

from azure.mgmt.monitor import MonitorManagementClient
from azure.common.credentials import ServicePrincipalCredentials

2. Set the required Azure credentials:

credentials = ServicePrincipalCredentials(
    client_id='<client-id>',
    secret='<client-secret>',
    tenant='<tenant-id>'
)

3. Initialize the MonitorManagementClient:

client = MonitorManagementClient(
    credentials=credentials,
    subscription_id='<subscription-id>'
)

4. Get a list of all the regions:

regions = [region.name for region in client.locations.list()]

5. For each region, check if a log profile exists:

for region in regions:
    log_profile = client.log_profiles.get(
        resource_group_name='<resource-group-name>',
        name='<log-profile-name>',
        location=region
    )
    
    if not log_profile:
        # If the log profile doesn't exist, create it
        client.log_profiles.create_or_update(
            resource_group_name='<resource-group-name>',
            log_profile_name='<log-profile-name>',
            parameters={
                'location': region,
                'categories': {
                    'write': True,
                    'delete': True
                }
            }
        )

6. Save the Python script and run it to remediate the misconfiguration.

Note: Replace the placeholders <client-id>, <client-secret>, <tenant-id>, <subscription-id>, <resource-group-name>, and <log-profile-name> with the actual values.

Using Terraform

resource "azurerm_monitor_log_profile" "activity_logs_all_regions" {
  name = "LOG_PROFILE_NAME" # replace with your log profile name

  # Export all activity log categories (adjust only if your policy requires specific ones)
  categories = [
    "Action",
    "Delete",
    "Write",
  ]

  # The key fix: include ALL Azure regions plus "global"
  # Replace the list below with the exact set of regions you use,
  # making sure "global" is present.
  locations = [
    "global",
    "eastus",
    "eastus2",
    "westus",
    "westus2",
    "centralus",
    "northcentralus",
    "southcentralus",
    # ...ADD ALL OTHER SUPPORTED AZURE REGIONS REQUIRED BY YOUR POLICY...
  ]

  retention_policy {
    enabled = true
    days    = RETENTION_DAYS # replace with the required retention period (integer)
  }

  storage_account_id = azurerm_storage_account.LOG_STORAGE_ACCOUNT_NAME.id
  # replace LOG_STORAGE_ACCOUNT_NAME with the Terraform resource name
  # for your log archive storage account
}

terraform plan should show the azurerm_monitor_log_profile resource being created or updated so that its locations list includes "global" and all required Azure regions.