# 5.2.5 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule

- Source: https://support.icompaas.com/support/solutions/articles/62000219862-5-2-5-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group-rule
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [5. Logging and Monitoring](https://support.icompaas.com/support/solutions/folders/62000167548)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

#### **Description:**

Create an activity log alert for the Create or Update Network Security Group Rule event.

  

#### **Rationale:**

Monitoring for Create or Update Network Security Group Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

  

#### **Default Value:**

By default, no monitoring alerts are created.

  

#### **Audit:**

**From Azure Console**

1.  Navigate to Monitor' / 'Alerts
    
2.  Select Manage alert rules
    
3.  Click on the Alert Name where Condition contains operationName equals Microsoft.Network/networkSecurityGroups/securityRules/write
    
4.  Hover a mouse over Condition to ensure it is set to Whenever the Administrative Activity Log "Create or Update Security Rule (networkSecurityGroups/securityRules)" has "any" level with "any" status and event is initiated by "any"  
    ![](https://support.icompaas.com/assets/kb/05d713916134ae93.png)
    

  

#### **Using Azure Command Line Interface**

  

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/microsoft.insights/ac tivityLogAlerts?api-version=2017-04-01' | jq '.|.value\[\]|{location:.location,scopes:.properties.scopes,"condition":.proper ties.condition.allOf|.\[\]|select(.field=="operationName" and
.equals=="microsoft.network/networksecuritygroups/securityrules/write"),enabl ed:.properties.enabled}'

Ensure that an alert exists where:

-   location is set to Global
    
-   Scopes is set to entire subscription that is /subscriptions/<Subscription\_ID>
    
-   Enabled set to True
    
-   Condition Matches:  
      
    
    {
    "location": "Global", "scopes": \[
    "/subscriptions/<Subscription\_ID>"
    \],
    "condition": {
    "field": "operationName",
    "equals": "microsoft.network/networksecuritygroups/securityrules/write", "containsAny": null
    },
    "enabled": true
    }
    

#### **Remediation:**

**From Azure Console**

1.  Go to Monitor  
    ![](https://support.icompaas.com/assets/kb/4408c84b27153951.png)
    
2.  Select Alerts  
    ![](https://support.icompaas.com/assets/kb/532769f52fd07353.png)
    
3.  Click On New Alert Rule  
    ![](https://support.icompaas.com/assets/kb/52524b7d52bd8edb.png)
    
4.  Under Scope, click Select resource  
    ![](https://support.icompaas.com/assets/kb/60271792b1b8bffd.png)
    
5.  Select the appropriate subscription under Filter by subscription
    
6.  Select Network Security Group Rules under Filter by resource type
    
7.  Select All for Filter by location
    
8.  Click on the subscription resource from the entries populated under Resource
    
9.  Click Done
    
10.  Verify Selection preview shows Network Security Group Rules and your selected subscription name
     
11.  Under Condition, click Add Condition
     
12.  Select Create or Update Network Security Group Rule signal
     
13.  Click Done
     
14.  Under Action group, select Add action groups and complete creation process or select appropriate action group
     
15.  Under Alert rule details, enter Alert rule name and Description
     
16.  Select appropriate resource group to save the alert to
     
17.  Check Enable alert rule upon creation checkbox
     
18.  Click Create alert rule
     

  

#### **Using Azure Command Line Interface**

Use the below command to create an Activity Log Alert for Create or Update Network Security Groups rule

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" 
https://management.azure.com/subscriptions/$0/resourceGroups/<Resource\_Group\_  To  Create\_Alert\_In>/providers/microsoft.insights/activityLogAlerts/<Unique\_Alert
\_Name>?api-version=2017-04-01 -d@"input.json"'

Where input.json contains the Request body JSON data as mentioned below.

{
"location": "Global", "tags": {}, "properties": {
"scopes": \[ "/subscriptions/<Subscription\_ID>"
\],
"enabled": true, "condition": {
"allOf": \[
{
"containsAny": null, "equals": "Administrative", "field": "category"
},
{
"containsAny": null, "equals":
"Microsoft.Network/networkSecurityGroups/securityRules/write", "field": "operationName"
}
\]
},
"actions": { "actionGroups": \[
{
"actionGroupId": "/subscriptions/<Subscription\_ID>/resourceGroups/<Resource\_Group\_For\_Alert\_Gr oup>/providers/microsoft.insights/actionGroups/<Alert\_Group>",
"webhookProperties": null
}
\]
},
}
}

Configurable Parameters for command line:

<Resource\_Group\_To Create\_Alert\_In>
<Unique\_Alert\_Name>

Configurable Parameters for input.json:

<Subscription\_ID> in scopes
<Subscription\_ID> in actionGroupId
<Resource\_Group\_For\_Alert\_Group> in actionGroupId
<Alert\_Group> in actionGroupId

  

#### **References:**

1.  [![](https://support.icompaas.com/assets/kb/b3d969585e3d1a62.png)](https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement)[Classic alerts in Azure Monitor to retire in June 2019 | Azure upda...](https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement) 
    
2.  [https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity- log](https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log")
    
3.  [https://docs.microsoft.com/en- in/rest/api/monitor/activitylogalerts/createorupdate](https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate "https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.