# Ensure that Activity Log Alert exists for Create or Update Network Security Group

- Source: https://support.icompaas.com/support/solutions/articles/62000219859-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [5. Logging and Monitoring](https://support.icompaas.com/support/solutions/folders/62000167548)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure Network Security Groups control inbound and outbound traffic for resources such as virtual machines, subnets, and NICs. Any creation or update to an NSG may introduce misconfigurations or open unintended access paths. Activity Log Alerts must be created to detect Create or Update NSG operations so that security teams are immediately notified of any network configuration changes. This helps ensure visibility, auditing, and rapid incident response for network-related security events.

  

Rationale:

This control verifies that an Activity Log Alert exists for operations related to Network Security Group creation or modification. The alert must monitor the operations of Microsoft. Network networkSecurityGroups write and Microsoft. Network networkSecurityGroups securityRules write. Without this alert, unauthorized NSG changes can occur without visibility, increasing the risk of exposure due to misconfigurations. Monitoring NSG changes is essential for detecting suspicious activity, preventing lateral movement, and maintaining compliance with security frameworks.

  

Impact:

-   Ensures real-time detection of NSG creation or modification.
    
-   Enhances Azure security monitoring and supports incident response workflows.
    
-   Reduces the risk of unauthorised exposure of network resources.
    
-   Helps meet compliance frameworks requiring network configuration change auditing (e.g., CIS, NIST, PCI).
    

  

Default Value:

Azure does not automatically create Activity Log Alerts for NSG operations. Users must create the alert manually in Azure Monitor.

  

Pre-Requisites:

-   Azure subscription with contributor or monitoring contributor permissions.
    
-   Ability to create or manage Activity Log Alerts, Action Groups
    
-   Resource subscriptions, resource Groups read, and Microsoft. Network networkSecurityGroups read.
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Navigate to Monitor
    
3.  Select Alerts and Open Alert rules
    
4.  Verify an Activity Log Alert exists for Create or Update Network Security Group (Network Security Group)
    
5.  Verify the alert scope includes the required subscription
    
6.  Verify that an Action Group is associated
    
7.  If the alert does not exist, follow the implementation steps
    

  

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Navigate to Monitor
    
3.  Select Alerts
    
4.  Click Create and select Alert rule
    

  

![](https://support.icompaas.com/assets/kb/e5f9772f0ef66bdf.png)

  

5.  Set the Scope to the required subscription
    
6.  Under Condition, click See all signals, search for Create or Update Network Security Group (Network Security Group), and select the signal.
    

  

![](https://support.icompaas.com/assets/kb/a6adee3ed119aec4.png)

  

7.  Associate with an Action Group
    
8.  Provide an alert rule name
    

![](https://support.icompaas.com/assets/kb/dc90afe00f503d60.png)

  

9.  Create the alert rule
    

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Navigate to Monitor
    
3.  Select Alerts and Open Alert rules
    
4.  Locate the Create or Update Network Security Group alert
    
5.  Delete the alert rule
    
6.  Confirm the deletion
    

  

Reference:

-   [https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-activity-log](https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-activity-log)
    
-   [https://learn.microsoft.com/rest/api/monitor/activitylogalerts](https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-activity-log)
    
-   [https://learn.microsoft.com/azure/security/benchmarks/security-controls-v3-logging-threat-detection](https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-activity-log)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.