Create Alert for Create or Update Security Solution Events

More Info:

Security solution changes have been detected within your Microsoft Azure cloud account.

Risk Level

High

Address

Security

Compliance Standards

• CIS AZURE
• Cloudanix Best Practice
• HIPAA
• ISO 27001

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration of "Create Alert for Create or Update Security Solution Events" for Azure using Azure console:

1. Login to the Azure portal (https://portal.azure.com/).
2. Click on "All services" on the left-hand side of the page and search for "Security Center" in the search bar.
3. Click on "Security Center" and select "Security policy" from the left-hand side menu.
4. In the "Security policy" page, click on the "Edit" button to edit the security policy.
5. Scroll down to the "Activity log alerts" section and click on the "Add activity log alert" button.
6. In the "Add activity log alert" page, fill in the required fields:
   • Name: Enter a name for the alert.
   • Description: Enter a description for the alert.
   • Subscription: Select the subscription in which you want to create the alert.
   • Resource group: Select the resource group in which you want to create the alert.
   • Event category: Select "Security" from the drop-down menu.
   • Event type: Select "Microsoft.Security/complianceResults/write" from the drop-down menu.
   • Severity: Select the severity level for the alert.
   • Action group: Select an action group to trigger when the alert is fired.
   • Tags: Add relevant tags if required.
7. Click on the "OK" button to create the alert.

Once the above steps are completed, you will have successfully remediated the misconfiguration of "Create Alert for Create or Update Security Solution Events" for Azure using Azure console. The alert will now be triggered whenever there is a "Create or Update Security Solution" event in your Azure environment.

Using CLI

To remediate the misconfiguration "Create Alert for 'Create or Update Security Solution' Events" in Azure using Azure CLI, follow the below steps:

Step 1: Open the Azure CLI in your local machine or Azure portal.

Step 2: Run the following command to create an alert rule for "Create or Update Security Solution" events:

az monitor metrics alert create -n <Alert_Rule_Name> --description <Description> --resource <Resource_ID> --condition "category=ServiceHealth severity=Error" --action <Action_Group_ID>

Here, replace the <Alert_Rule_Name> with the name of the alert rule you want to create, <Description> with the description of the alert rule, <Resource_ID> with the ID of the resource for which you want to create the alert, and <Action_Group_ID> with the ID of the action group to which you want to send the alert notification.

Step 3: Verify the alert rule by running the following command:

az monitor metrics alert show -n <Alert_Rule_Name> -g <Resource_Group_Name>

Here, replace the <Alert_Rule_Name> with the name of the alert rule you created in step 2, and <Resource_Group_Name> with the name of the resource group where the resource is located.

Step 4: If the alert rule is working correctly, you will receive notifications whenever a "Create or Update Security Solution" event occurs.

Note: You can also create the alert rule using the Azure portal or Azure PowerShell.

Using Python

To remediate this misconfiguration in Azure, you can use the Azure SDK for Python to create an alert for "Create or Update Security Solution" events. Here are the steps:

1. Install the Azure SDK for Python by running the following command in your terminal:

pip install azure-mgmt-monitor

2. Import the necessary modules in your Python script:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import RuleCondition, ManagementEventRuleCondition, ManagementEventAggregationCondition, \
    RuleAction, AlertRuleResource, AlertRuleAllOfCondition, AlertRuleLeafCondition, AlertRuleAnyOfOrLeafCondition

3. Set up your Azure credentials by creating a Service Principal and assigning it the necessary permissions. You will need the following information:

• Subscription ID
• Tenant ID
• Client ID
• Client Secret

subscription_id = '<your-subscription-id>'
tenant_id = '<your-tenant-id>'
client_id = '<your-client-id>'
client_secret = '<your-client-secret>'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=client_secret,
    tenant=tenant_id
)

4. Create an instance of the MonitorManagementClient:

monitor_client = MonitorManagementClient(credentials, subscription_id)

5. Define the conditions for the alert rule. In this case, we want to create an alert for "Create or Update Security Solution" events. We will use the ManagementEventRuleCondition to specify this:

management_event_condition = ManagementEventRuleCondition(
    all_of=[AlertRuleAllOfCondition(
        field='operationName',
        equals='Microsoft.Security/securitySolutions/write'
    )]
)

6. Define the actions to take when the alert is triggered. In this case, we will send an email to a specified email address:

action_group_id = '<your-action-group-id>'

action = RuleAction(
    action_group_id=action_group_id
)

7. Create the alert rule:

alert_rule = AlertRuleResource(
    location='global',
    alert_rule_resource_name='security-solution-create-update',
    description='Alert for Create or Update Security Solution events',
    condition=AlertRuleLeafCondition(
        all_of=[AlertRuleAnyOfOrLeafCondition(
            management_event=management_event_condition
        )]
    ),
    actions=[action],
    is_enabled=True
)

monitor_client.alert_rules.create_or_update(
    resource_group_name='<your-resource-group-name>',
    rule_name='security-solution-create-update',
    parameters=alert_rule
)

This will create an alert rule in Azure that will trigger an email notification when a "Create or Update Security Solution" event occurs. You can customize the alert rule by changing the conditions and actions as needed.

Using Terraform

# Replace the placeholders with your actual values:
# - SUBSCRIPTION_ID: the subscription to monitor
# - RESOURCE_GROUP_NAME: where to place the alert and action group
# - LOCATION: Azure region (e.g. "eastus")
# - ALERT_NAME: friendly name for the alert rule
# - ACTION_GROUP_NAME: friendly name for the action group
# - ACTION_GROUP_SHORT_NAME: short name (2–12 characters)
# - EMAIL_RECEIVER_NAME / EMAIL_ADDRESS: who should be notified

data "azurerm_subscription" "current" {
  subscription_id = "SUBSCRIPTION_ID"
}

resource "azurerm_resource_group" "monitor_rg" {
  name     = "RESOURCE_GROUP_NAME"
  location = "LOCATION"
}

resource "azurerm_monitor_action_group" "security_solution_changes" {
  name                = "ACTION_GROUP_NAME"
  resource_group_name = azurerm_resource_group.monitor_rg.name
  short_name          = "ACTION_GROUP_SHORT_NAME"

  email_receiver {
    name                    = "EMAIL_RECEIVER_NAME"
    email_address           = "EMAIL_ADDRESS"
    use_common_alert_schema = true
  }
}

resource "azurerm_monitor_activity_log_alert" "security_solution_create_update" {
  name                = "ALERT_NAME"
  resource_group_name = azurerm_resource_group.monitor_rg.name
  scopes              = [data.azurerm_subscription.current.id]
  description         = "Alert on Create or Update Security Solution events in Activity Log"

  criteria {
    category       = "Security"
    operation_name = "Create or Update Security Solution"
  }

  action {
    action_group_id = azurerm_monitor_action_group.security_solution_changes.id
  }

  # Optional: ensure the alert is enabled
  enabled = true
}

This configuration creates an Azure Monitor Activity Log alert that fires whenever a “Create or Update Security Solution” event is logged and sends notifications via the configured action group.

After updating your Terraform, terraform plan should show one new azurerm_monitor_action_group and one new azurerm_monitor_activity_log_alert to be created, with the criteria.operation_name exactly set to "Create or Update Security Solution".