5. Logging and Monitoring

Ensure that a 'Diagnostics Setting' exists for exporting activity logs
Description: Azure resources generate control-plane logs that record create, update, delete, policy changes, RBAC actions, and configuration updates. Diagn...
Tue, 13 Jan, 2026 at 1:56 PM
Ensure Diagnostic Setting captures appropriate categories from the control/management plane
Description: Azure resources generate control-plane (management-plane) logs that capture administrative operations such as create, update, delete, policy e...
Tue, 13 Jan, 2026 at 1:52 PM
Ensure the storage container storing the activity logs is not publicly accessible
Description: The storage account container that stores exported Azure Activity Logs must not be publicly accessible. Activity logs contain sensitive operat...
Wed, 31 Dec, 2025 at 3:30 AM
Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key
Description: Storage Account encryption with Customer Managed Keys (CMK) provides an additional layer of security by using an organization's own Azure ...
Wed, 31 Dec, 2025 at 3:34 AM
5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
Description: Create an activity log alert for the Delete Policy Assignment event. Rationale: Monitoring for delete policy assignment events gives insi...
Tue, 22 Aug, 2023 at 5:02 AM
Ensure that Activity Log Alert exists for Create or Update Network Security Group
Description: Azure Network Security Groups control inbound and outbound traffic for resources such as virtual machines, subnets, and NICs. Any creation or ...
Wed, 31 Dec, 2025 at 3:58 AM
5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group
Description: Create an activity log alert for the Delete Network Security Group event. Rationale: Monitoring for "Delete Network Security Group&q...
Tue, 22 Aug, 2023 at 4:46 AM
5.2.5 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule
Description: Create an activity log alert for the Create or Update Network Security Group Rule event. Rationale: Monitoring for Create or Update Netwo...
Wed, 9 Aug, 2023 at 8:23 AM
Ensure that activity log alert exists for the Delete Network Security Group Rule
Description: Azure Network Security Groups (NSGs) enforce network filtering rules for virtual machines, subnets, and other Azure resources. Deleting an NSG...
Wed, 31 Dec, 2025 at 4:03 AM
Ensure that Activity Log Alert exists for Create or Update Security Solution
Description: Azure Security Solutions include integrations such as vulnerability scanners, endpoint protection services, SIEM connectors, and third-party t...
Wed, 31 Dec, 2025 at 4:07 AM