Create Alert for Delete Security Solution Events

More Info:

Security solution changes have been detected within your Microsoft Azure cloud account.

Risk Level

High

Address

Security

Compliance Standards

• CIS AZURE
• Cloudanix Best Practice
• HIPAA
• ISO 27001

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of creating an alert for "Delete Security Solution" events in Azure using the Azure console:

1. Open the Azure portal and navigate to the Security Center.

2. Click on "Security policy" from the left-hand menu.

3. Select the policy that you want to update.

4. Scroll down to the "Alerts" section and click on "Add alert".

5. In the "Create alert rule" window, select the "Activity log" option.

6. Under "Event types", select "Service Health" and then select "Service health status changes".

7. In the "Service health status changes" section, select "Resolved" and "Dismissed" as the status changes to be alerted for.

8. Under "Actions", select "Email/SMS/Push/Voice" and add the email addresses of the people who should be alerted.

9. Click on "Create alert rule" to save the configuration.

Once you have followed these steps, you should receive an alert whenever a "Delete Security Solution" event is detected in Azure. This will help you to take immediate action to remediate any potential security risks.

Using CLI

To remediate the misconfiguration of not having an alert for "Delete Security Solution" events in Azure using Azure CLI, follow these steps:

1. Open the Azure CLI on your local machine or Azure Cloud Shell.
2. Run the following command to create a new activity log alert rule:

az monitor activity-log alert create --name <alert-name> --description <alert-description> --resource-group <resource-group-name> --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/delete --action <action-group-name> --enabled true

Replace the placeholders <alert-name>, <alert-description>, <resource-group-name>, and <action-group-name> with the appropriate values for your environment.

3. The --condition parameter specifies the condition for the alert rule. In this case, it is set to trigger when an administrative action is taken to delete a security solution. You can modify this condition to suit your specific needs.
4. The --action parameter specifies the action to take when the alert is triggered. You can specify an action group that contains one or more actions, such as sending an email notification or invoking a webhook.
5. Once the command completes successfully, the alert rule will be created and enabled.

By following these steps, you will have successfully remediated the misconfiguration of not having an alert for "Delete Security Solution" events in Azure using Azure CLI.

Using Python

To remediate the misconfiguration of not having an alert for "Delete Security Solution" events in Azure, you can follow these steps using Python:

1. Install the Azure SDK for Python using the following command:

pip install azure-mgmt-monitor

2. Import the required modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import RuleCondition, ManagementEventAggregationCondition, RuleDataSource, RuleMetricDataSourceConfiguration, RuleManagementEventClaimsDataSourceConfiguration, RuleEmailAction, RuleAction

3. Set up the Azure credentials by creating a Service Principal:

subscription_id = '<your-subscription-id>'
client_id = '<your-client-id>'
client_secret = '<your-client-secret>'
tenant_id = '<your-tenant-id>'

credentials = ServicePrincipalCredentials(client_id=client_id, secret=client_secret, tenant=tenant_id)

4. Create a MonitorManagementClient object:

monitor_client = MonitorManagementClient(credentials, subscription_id)

5. Define the alert rule condition:

condition = RuleCondition(
    data_source=RuleDataSource(
        type='Microsoft.Insights/scheduledQueryResults',
        query='SecurityEvent\n| where EventID == "4688"\n| where TimeGenerated > ago(1d)\n| where OperationName == "Microsoft.Compute/virtualMachines/delete"\n| project ResourceId, ResourceGroupName, Computer, Caller, TimeGenerated'
    ),
    window_size='PT5M',
    all_of=[
        ManagementEventAggregationCondition(
            metric_name='count',
            operator='GreaterThan',
            threshold=0,
            metric_namespace='Microsoft.Insights/scheduledQueryResults',
            dimensions=[
                {
                    'name': 'ResourceId',
                    'operator': 'Include',
                    'values': [
                        '*'
                    ]
                }
            ],
            time_aggregation='Average'
        )
    ]
)

6. Define the alert rule action:

action = RuleAction(
    send_email=RuleEmailAction(
        custom_emails=[
            '<your-email-address>'
        ],
        send_to_service_owners=False,
        send_to_subscription_administrators=False
    )
)

7. Create the alert rule:

rule_name = 'Delete Security Solution Alert'
resource_group_name = '<your-resource-group-name>'
location = '<your-location>'

data_source_config = RuleMetricDataSourceConfiguration(
    metric_name='count',
    metric_namespace='Microsoft.Insights/scheduledQueryResults',
    resource_uri='/subscriptions/{0}'.format(subscription_id)
)

claims_data_source_config = RuleManagementEventClaimsDataSourceConfiguration()

monitor_client.alert_rules.create_or_update(
    resource_group_name=resource_group_name,
    rule_name=rule_name,
    parameters={
        'location': location,
        'description': 'Alert rule for detecting delete security solution events',
        'is_enabled': True,
        'condition': condition,
        'actions': [action],
        'data_source': data_source_config,
        'claims_data_source': claims_data_source_config
    }
)

This will create an alert rule in Azure that will send an email notification to the specified email address when a "Delete Security Solution" event is detected.

Using Terraform

resource "azurerm_monitor_activity_log_alert" "delete_security_solution_alert" {
  name                = "DELETE-SECURITY-SOLUTION-ACTIVITY-ALERT"
  resource_group_name = "RESOURCE_GROUP_NAME"          # replace with the resource group for the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"]  # replace with your subscription ID

  description = "Alert on Delete Security Solution events in Azure Activity Log"
  enabled     = true

  criteria {
    category       = "Security"
    operation_name = "Microsoft.Security/securitySolutions/delete"
  }

  action {
    action_group_id = azurerm_monitor_action_group.security_alerts.id
  }

  tags = {
    Environment = "ENVIRONMENT_TAG" # replace or remove as needed
  }
}

resource "azurerm_monitor_action_group" "security_alerts" {
  name                = "security-alerts-ag"
  resource_group_name = "RESOURCE_GROUP_NAME"          # same or another RG as desired
  short_name          = "secalerts"

  email_receiver {
    name          = "security-team-email"
    email_address = "SECURITY_TEAM_EMAIL@example.com"  # replace with your email
  }
}

This change does not force replacement of existing workloads, but it will create new Azure Monitor resources; removing or renaming them later will destroy/recreate only the alerting objects.

To verify, terraform plan should show creation of azurerm_monitor_activity_log_alert.delete_security_solution_alert and azurerm_monitor_action_group.security_alerts with the specified criteria on operation_name = "Microsoft.Security/securitySolutions/delete".