Skip to main content

Activity Log Alert exists for Create or Update Network

More Info:​

Monitoring for Create or Update Network Security Group Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Risk Level​

Low

Address​

Operational Maturity, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AZURE
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" in Azure using the Azure console:

  1. Log in to the Azure portal using your credentials.
  2. In the Azure portal, click on the "Security Center" icon in the left-hand menu.
  3. Select "Security policy" from the Security Center menu.
  4. In the "Security policy" page, click on the "Activity Log Alerts" option.
  5. On the "Activity Log Alerts" page, click on the "+ Add activity log alert" button.
  6. In the "Add activity log alert" page, select the "Resource Group" or "Subscription" that you want to create the alert for.
  7. In the "Condition" section, select "Service" as "Network Security Group Rule" and "Operation" as "Write".
  8. In the "Action group" section, select the action group that you want to use for the alert.
  9. In the "Alert details" section, provide a name and description for the alert.
  10. Click on the "Create alert rule" button to create the alert.

Once you have completed these steps, the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" will be remediated in Azure. The alert will notify you when a new network security group rule is created or updated, which will help you identify any potential security issues.

Using CLI

To remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" in Azure using Azure CLI, you can follow the below steps:

  1. Open the Azure CLI and login to your Azure account by running the command:

    az login

  2. Once you are logged in, set the subscription where the misconfiguration exists by running the command:

    az account set --subscription <subscription_id>

    Replace <subscription_id> with the ID of the subscription where the misconfiguration exists.

  3. Create an Activity Log Alert for Network Security Group Rule creation or update by running the command:

    az monitor activity-log alert create --name <alert_name> --description <alert_description> --condition category=Administrative and resourceType=Microsoft.Network/networkSecurityGroups and operationName=Microsoft.Network/networkSecurityGroups/securityRules/write --action-group <action_group_id> --enabled true

    Replace <alert_name> with a name for the alert, <alert_description> with a description for the alert, and <action_group_id> with the ID of an existing action group that will be notified when the alert is triggered.

  4. Verify that the Activity Log Alert was created successfully by running the command:

    az monitor activity-log alert show --name <alert_name>

    Replace <alert_name> with the name of the alert that you created.

  5. Once the Activity Log Alert is created, it will trigger whenever there is a Create or Update operation on a Network Security Group Rule. The action group that you specified will be notified when the alert is triggered.

By following the above steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" in Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" for Azure using Python, you can follow these steps:

  1. Install the necessary Python packages:
pip install azure-mgmt-monitor
pip install azure.identity
  1. Authenticate to Azure using Python:
from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient

credential = DefaultAzureCredential()
subscription_id = '<your-subscription-id>'

monitor_client = MonitorManagementClient(credential, subscription_id)
  1. Create a new activity log alert:
from azure.mgmt.monitor.models import (ActivityLogAlertActionList, ActivityLogAlertAllOfCondition, ActivityLogAlertLeafCondition, ActivityLogAlertList, ActivityLogAlertResourceRegionCondition)

alert_name = '<your-alert-name>'
resource_group_name = '<your-resource-group-name>'
nsg_name = '<your-nsg-name>'

condition = ActivityLogAlertAllOfCondition(
    all_of=[
        ActivityLogAlertLeafCondition(
            field='category',
            equals='Administrative'
        ),
        ActivityLogAlertLeafCondition(
            field='resourceType',
            equals='Microsoft.Network/networkSecurityGroups/securityRules'
        ),
        ActivityLogAlertLeafCondition(
            field='operationName',
            equals='Microsoft.Network/networkSecurityGroups/securityRules/write'
        ),
        ActivityLogAlertResourceRegionCondition(
            field='resourceRegion',
            equals='<your-region>'
        )
    ]
)

actions = ActivityLogAlertActionList(
    action_groups=[]
)

monitor_client.activity_log_alerts.create_or_update(
    resource_group_name=resource_group_name,
    activity_log_alert_name=alert_name,
    activity_log_alert=ActivityLogAlertList(
        scopes=[
            f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.Network/networkSecurityGroups/{nsg_name}"
        ],
        condition=condition,
        actions=actions
    )
)
  1. Verify that the activity log alert has been created:
alert = monitor_client.activity_log_alerts.get(
    resource_group_name=resource_group_name,
    activity_log_alert_name=alert_name
)

print(alert)

This should remediate the misconfiguration "Ensure Activity Log Alert exists for Create or Update Network Security Group Rule" for Azure using Python.

Using Terraform
resource "azurerm_monitor_activity_log_alert" "nsg_rule_create_update" {
  name                = "nsg-rule-create-update-alert"
  resource_group_name = "RESOURCE_GROUP_NAME"          # replace with the resource group to hold the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"] # replace with your subscription ID
  description         = "Alert on Create or Update of Network Security Group rules"
  enabled             = true

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Network/networkSecurityGroups/securityRules/write"
  }

  action {
    action_group_id = azurerm_monitor_action_group.nsg_alerts.id
  }
}

resource "azurerm_monitor_action_group" "nsg_alerts" {
  name                = "nsg-alert-action-group"
  resource_group_name = "RESOURCE_GROUP_NAME"          # same or another RG as desired
  short_name          = "nsgalerts"

  email_receiver {
    name          = "nsg-alert-email"
    email_address = "ALERT_EMAIL_ADDRESS"              # replace with a real email
  }
}

This adds an Activity Log Alert that fires whenever a Network Security Group rule is created or updated; it does not force replacement of existing NSGs or rules, only (if present) replacement of an existing alert with the same name.

For verification, terraform plan should show creation (or in-place update) of azurerm_monitor_activity_log_alert.nsg_rule_create_update and its criteria.operation_name set to Microsoft.Network/networkSecurityGroups/securityRules/write, plus the associated azurerm_monitor_action_group.nsg_alerts.

Additional Reading:​