Description:

An Activity Log Alert for Delete Network Security Group (NSG) ensures that any attempt to delete a Network Security Group (NSG) in your Azure environment triggers a notification. NSGs are essential for controlling traffic to and from Azure resources within a Virtual Network. Deleting an NSG can result in unintended disruptions to traffic flow and expose resources to security risks. By creating an Activity Log Alert for Delete NSG actions, you can track and respond to these changes promptly, ensuring that accidental or unauthorized deletions are detected and addressed immediately.

Rationale:

NSGs are critical for network security, and their deletion can significantly affect the security posture of your environment. By configuring an Activity Log Alert for Delete NSG actions, you can:

  • Track NSG deletions and monitor changes in network access control.

  • Prevent unauthorized changes to your network security policies.

  • Improve security by notifying administrators when an NSG is deleted, reducing the risk of exposed resources or service disruptions.

  • Ensure compliance by maintaining an audit trail of network security rule changes.

Impact:

Configuring this Activity Log Alert ensures that any deletions of NSGs are immediately brought to your attention. This allows for quick action to investigate and restore security configurations as needed. However, this could lead to an increase in alert volume, especially in environments where NSGs are frequently updated or deleted as part of operational changes. Proper alert management and filtering will be essential to handle these notifications appropriately.

Default Value:

By default, there are no Activity Log Alerts configured for Delete Network Security Group actions. You need to manually create and configure these alerts to track and respond to such events.

Pre-requisites:

  • Azure subscription.

  • Owner or Contributor role permissions to create Activity Log Alerts.

  • Azure Monitor enabled for logging.

  • Log Analytics workspace (optional, for storing telemetry data).

  • Network Security Groups deployed in your Azure environment.

Audit:

  1. Sign in to Azure portal as an Owner, Contributor, or Monitoring Contributor.

  2. Navigate to Azure Monitor and review the Activity Log Alerts to ensure that alerts for Delete Network Security Group actions are configured.

  3. Verify that the configured alert is properly notifying users when an NSG is deleted.

Implementation Steps (Automated):

  1. Sign in to Azure portal:

    • Use an account with Owner, Contributor, or Monitoring Contributor permissions.

  2. Navigate to Azure Monitor:

    • In the Azure portal, go to Azure Monitor and select Activity Log under Monitoring.

  3. Create a New Alert for Delete Network Security Group:

    • In Activity Log Alerts, click on + New alert rule.

    • Under Scope, select your subscription or resource group.

    • Under Condition, choose Activity Log as the signal type.

    • Set the Event Category to Delete and the Resource Type to Microsoft.Network/networkSecurityGroups.

    • Filter further by Operation Name: Delete Network Security Group.

  4. Example of criteria:

    • Event Category: Delete

    • Operation Name: Delete Network Security Group

    • Resource Type: Microsoft.Network/networkSecurityGroups

  5. Set Up Action Group:

    • Under Action Group, either select an existing action group or create a new one to define how the alert will notify you (e.g., via Email, SMS, Webhook).

    • You can send notifications to security teams or network administrators whenever a Network Security Group is deleted.

  6. Review and Create:

    • Review the configuration and ensure the alert is set to notify you when a Network Security Group is deleted.

    • Click Create to save the alert rule.

Automate Alert Creation Using Azure CLI: To automate the creation of an Activity Log Alert for Delete Network Security Group using Azure CLI, run the following command:

az monitor activity-log alert create \

    --name "DeleteNSGAlert" \

    --resource-group <Resource-Group-Name> \

    --condition "operationName == 'Delete Network Security Group'" \

    --action-group <Action-Group-ID> \

    --description "Alert for deletion of Network Security Group" \

    --enabled true

  1.  Replace <Resource-Group-Name> and <Action-Group-ID> with the appropriate values for your environment.

  2. Test the Alert:

    • After configuring the Activity Log Alert, test it by deleting a Network Security Group and ensuring that the alert is triggered and the notification is sent to the designated recipients.

  3. Monitor and Review Alerts:

    • Use Azure Monitor to track the alert history and ensure that it is functioning as expected.

    • Review the alert history to verify that Network Security Group deletions are being logged.

Backout Plan (Automated):

  1. Sign in to Azure portal:

    • Use an account with Owner, Contributor, or Monitoring Contributor permissions.

  2. Navigate to Azure Monitor:

    • Go to Azure Monitor in the Azure portal.

  3. Delete or Modify the Alert:

    • In Activity Log Alerts, locate the Delete Network Security Group alert you created.

    • Select the alert and either delete it or modify its parameters as needed (e.g., change the notification action group, adjust alert criteria).

  4. Verify Alert Removal:

    • After removing or modifying the alert, ensure that it no longer triggers notifications for Delete Network Security Group events.

  5. Test the Backout:

    • Test the configuration by deleting a Network Security Group to ensure that the alert no longer triggers or functions as expected after the backout.

References: