59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
id: azure-policy-assignment-delete-unalerted
|
|
info:
|
|
name: Azure Policy Assignment Delete Alert Not Configured
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that an Azure activity log alert is used to detect "Delete Policy Assignment" events within your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the condition used is 'Whenever the Policy Activity Log "Delete policy assignment (policyAssignments)" has "any" level, with "any" status and event is initiated by "any"'.
|
|
impact: |
|
|
Failing to monitor "Delete Policy Assignment" events can lead to unauthorized policy changes that could affect resource compliance and security without notice.
|
|
remediation: |
|
|
Configure alert rules to monitor and notify on "Delete Policy Assignment" events by setting the alert condition to "Microsoft.Authorization/policyAssignments/delete" and ensuring that an action group is attached for notifications.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log
|
|
tags: cloud,devops,azure,microsoft,policy-assignment,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let AlertData of iterate(template.alertList)) {
|
|
set("id", AlertData);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az monitor activity-log alert list --output json --query '[?(enabled==`true`)].id'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: alertList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az monitor activity-log alert show --ids "$id" --query 'condition'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"field": "operationName"'
|
|
|
|
- type: word
|
|
words:
|
|
- "Microsoft.Authorization/policyAssignments/delete"
|
|
negative: true
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'id + " does not have the correct alert configuration for Delete Policy Assignment events"'
|
|
# digest: 4a0a0047304502202cdee3f598ca8aef10a5d81090b3d5d2db1bb6153f666be2d22cb5435d701667022100a5522ef65e80858c564e88d266a7f9a98d2c20120a3d3db22f2447314b587f87:922c64590222798bb761d5b6d8e72950 |