Risk Level: Low
Cloud Entity: Azure Monitor Logs
CloudGuard Rule ID: D9.AZU.MON.47
Covered by Spectral: No
Category: Management Tools

GSL LOGIC

ActivityLogMonitor should have diagnosticSettings contain [ logs contain [ enabled=true ] ]

REMEDIATION

From Portal

Sign in to Azure Management Console.
Go to 'Azure Monitor'.
Click on 'Diagnostic settings'.
Click on the resource that has a diagnostics status of disabled
Click on 'Add diagnostic setting'.
Enter a name for your new Diagnostic Setting.
Select the appropriate log, metric, and destination. (This may be Log Analytics/Storage account or Event Hub).
Repeat these step for all resources as needed.
Note: By default, diagnostic setting is not set.

From TF
Set the 'enabled' argument to 'true' as below:

resource "azurerm_monitor_diagnostic_setting" "example" {
	...
	log {
		...
		category = "CATEGORY"
		enabled  = true
		...
	}
	...
}

From Command Line
Run

az monitor diagnostic-settings create --resource ID --name NAME --storage-account STORAGEACCOUNTNAME --logs '@{file}'

NOTE : Use '@{file}' to load from a file. It contains JSON encoded list of logs settings.

References

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting
https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_create
https://learn.microsoft.com/en-us/rest/api/monitor/diagnostic-settings/create-or-update?tabs=HTTP#logsettings

Azure Monitor Logs

Azure Monitor Logs is a feature of Azure Monitor that collects and organizes log and performance data from monitored resources. Data from multiple sources can be consolidated into a single workspace.

Compliance Frameworks

Azure CIS Foundations v. 1.3.1
Azure CIS Foundations v. 1.4.0
Azure CIS Foundations v. 1.5.0
Azure CIS Foundations v.2.0
Azure CloudGuard Best Practices
Azure HITRUST v9.5.0
Azure ITSG-33
Azure NIST 800-53 Rev 5
CloudGuard Azure All Rules Ruleset