Microsoft.web.customapis.delete

​

Event Information

1. The Microsoft.Web.customApis.Delete event in Azure for AzureWebService refers to the deletion of a custom API within the Azure Web Service.
2. This event indicates that a custom API, which is a user-defined API endpoint, has been removed from the Azure Web Service.
3. The event can be used to track and monitor changes to the custom APIs within the Azure Web Service, providing visibility into the management and modification of these APIs.

​

Examples

1. Unauthorized deletion: If security is impacted with Microsoft.Web.customApis.Delete in Azure for AzureWebService, it could potentially allow unauthorized users to delete custom APIs. This could lead to the loss of critical functionality and data within the Azure Web Service.
2. Data exposure: If security is impacted with Microsoft.Web.customApis.Delete in Azure for AzureWebService, it may result in the exposure of sensitive data associated with the custom APIs. This could include API keys, authentication credentials, or any other confidential information stored within the custom APIs.
3. Service disruption: If security is impacted with Microsoft.Web.customApis.Delete in Azure for AzureWebService, it could lead to service disruption for the Azure Web Service. Unauthorized deletion of custom APIs may cause the service to become unavailable or result in unexpected behavior, impacting the availability and reliability of the application or service relying on those APIs.

​

Remediation

​

Using Console

1. Enable Azure Security Center:
   • Go to the Azure portal and search for “Security Center” in the search bar.
   • Select “Security Center” from the results and click on it.
   • In the Security Center dashboard, click on “Pricing & settings” in the left-hand menu.
   • Choose the subscription and resource group where your AzureWebService is located.
   • Click on “Apply to all resources” to enable Security Center for all resources in the selected resource group.
   • Review the pricing tier options and select the appropriate tier for your needs.
   • Click on “Save” to enable Security Center.
2. Configure Network Security Groups (NSGs):
   • Go to the Azure portal and search for “Virtual machines” in the search bar.
   • Select “Virtual machines” from the results and click on it.
   • Find the virtual machine(s) associated with your AzureWebService.
   • Click on the virtual machine to open its details page.
   • In the left-hand menu, click on “Networking” and then “Network security group”.
   • Click on “Create new” to create a new NSG or select an existing NSG.
   • Configure inbound and outbound security rules based on your requirements and compliance standards.
   • Click on “Save” to apply the NSG to the virtual machine.
3. Implement Azure Monitor:
   • Go to the Azure portal and search for “Monitor” in the search bar.
   • Select “Monitor” from the results and click on it.
   • In the Monitor dashboard, click on “Virtual machines” in the left-hand menu.
   • Find the virtual machine(s) associated with your AzureWebService.
   • Click on the virtual machine to open its details page.
   • In the left-hand menu, click on “Alerts” and then “New alert rule”.
   • Configure the alert rule based on the specific event or metric you want to monitor.
   • Specify the action group to be notified when the alert is triggered.
   • Click on “Create alert rule” to save the configuration.

​

Using CLI

1. Enable diagnostic logs:
   • Use the az webapp log config command to enable diagnostic logs for the Azure Web Service.
   • Specify the desired log level and retention days using the --web-server-logging and --detailed-error-messages parameters respectively.
2. Enable Azure Monitor:
   • Use the az monitor app-insights component create command to create an Application Insights resource.
   • Associate the Application Insights resource with your Azure Web Service using the az webapp config appsettings set command.
   • Set the APPINSIGHTS_INSTRUMENTATIONKEY app setting to the Instrumentation Key of the created Application Insights resource.
3. Implement Azure Security Center recommendations:
   • Use the az security secure-score-controls list command to list the available security controls.
   • Identify the relevant security control for Azure Web Service and its associated recommendation ID.
   • Use the az security secure-score-controls update command to enable or disable the specific security control based on the recommendation ID.

​

Using Python

1. Monitoring and Alerting:
   • Use the Azure Monitor service to set up monitoring and alerting for your Azure Web Service.
   • Create a metric alert to trigger an action when a specific condition is met, such as high CPU usage or low memory availability.
   • Use the Azure SDK for Python to programmatically create and manage alerts. Here’s an example script:
   Copy

   Ask AI

   from azure.mgmt.monitor import MonitorManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a MonitorManagementClient
   monitor_client = MonitorManagementClient(credential, subscription_id)
   
   # Define the alert rule parameters
   alert_rule_params = {
       'location': 'eastus',
       'name': 'High CPU Alert',
       'description': 'Alert triggered when CPU usage exceeds 80%',
       'severity': 2,
       'enabled': True,
       'condition': {
           'odata.type': 'Microsoft.Azure.Management.Monitor.Models.ThresholdRuleCondition',
           'dataSource': {
               'odata.type': 'Microsoft.Azure.Management.Monitor.Models.RuleMetricDataSource',
               'resourceUri': '/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Web/sites/{web_service_name}',
               'metricName': 'CpuPercentage',
               'operator': 'GreaterThan',
               'threshold': 80
           }
       },
       'actions': [
           {
               'odata.type': 'Microsoft.Azure.Management.Monitor.Models.RuleEmailAction',
               'sendToServiceOwners': True
           }
       ]
   }
   
   # Create the alert rule
   monitor_client.alert_rules.create_or_update(
       resource_group_name,
       web_service_name,
       alert_rule_name,
       alert_rule_params
   )
   

2. Security and Compliance:
   • Implement Azure Security Center to continuously monitor the security posture of your Azure Web Service.
   • Enable Azure Security Center’s Just-In-Time (JIT) VM Access feature to restrict access to your virtual machines.
   • Use the Azure SDK for Python to programmatically enable JIT VM Access. Here’s an example script:
   Copy

   Ask AI

   from azure.mgmt.security import SecurityCenterManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a SecurityCenterManagementClient
   security_center_client = SecurityCenterManagementClient(credential, subscription_id)
   
   # Enable JIT VM Access for the web service's virtual machines
   security_center_client.jit_network_access_policies.create_or_update(
       resource_group_name,
       web_service_name,
       'default',
       {
           'location': 'eastus',
           'virtualMachines': [
               {
                   'id': '/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Compute/virtualMachines/{vm_name}',
                   'ports': [
                       {
                           'number': 22,
                           'protocol': 'Tcp',
                           'allowedSourceAddressPrefixes': ['0.0.0.0/0']
                       }
                   ]
               }
           ]
       }
   )
   

3. Cost Optimization:
   • Utilize Azure Cost Management and Billing to monitor and optimize the costs of your Azure Web Service.
   • Enable cost alerts to receive notifications when your spending exceeds a certain threshold.
   • Use the Azure SDK for Python to programmatically create cost alerts. Here’s an example script:
   Copy

   Ask AI

   from azure.mgmt.costmanagement import CostManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a CostManagementClient
   cost_management_client = CostManagementClient(credential, subscription_id)
   
   # Define the cost alert parameters
   cost_alert_params = {
       'name': 'High Cost Alert',
       'description': 'Alert triggered when monthly spending exceeds $1000',
       'enabled': True,
       'threshold': 1000,
       'time_grain': 'Monthly',
       'time_window': 'PT1H',
       'query': "cost > 1000"
   }
   
   # Create the cost alert
   cost_management_client.alerts.create_or_update(
       resource_group_name,
       'default',
       cost_alert_params
   )