Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule

Risk Level: Low
Cloud Entity: Azure Alert Rule
CloudGuard Rule ID: D9.AZU.MON.84
Covered by Spectral: No
Category: Management Tools

GSL LOGIC

List<ActivityLogAlertRule> should have items with [condition.allOf contain [ field='operationName' and equals='Microsoft.Sql/servers/firewallRules/delete' ] and enabled=true and not condition.allOf contain [ field='level' ] and not condition.allOf contain [ field='status' ] ]

REMEDIATION

From Portal

1. Navigate to the Monitor blade.
2. Select Alerts and then Create.
3. Select Alert rule. Under Filter by subscription, choose a subscription.
4. Under Filter by resource type, select Server Firewall Rule (servers/firewallRules).Under Filter by location, select All.
5. From the results, select the subscription and then Done.
6. Now, Select the Condition tab. Under Signal name, click Delete server firewall rule (Microsoft.Sql/servers/firewallRules).
7. Select the Actions tab. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection.
8. Select the Details tab.Select a Resource group, provide an Alert rule name and an optional Alert rule description.
9. Click Review + create and Click Create.

From Command Line
Run

az monitor activity-log alert create --resource-group RESOURCEGROUP --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level= verbose | information | warning | error | critical --scope SUBSCRIPTION --name ACTIVITYLOGNAME --subscription SUBSCRIPTIONID --action-group ACTIONGROUPID --location global

References

1. https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate
2. https://learn.microsoft.com/en-in/rest/api/monitor/activity-log-alerts/delete?tabs=HTTP
3. https://workbench.cisecurity.org/sections/1460918/recommendations/2349121

Azure Alert Rule

Alerts proactively notify you when issues are found with your infrastructure or application using your monitoring data in Azure Monitor. They allow you to identify and address issues before the users of your system notice them.Alert rules are separated from alerts and the actions taken when an alert fires. The alert rule captures the target and criteria for alerting. The alert rule can be in an enabled or a disabled state. Alerts only fire when enabled.

Compliance Frameworks

• Azure CIS Foundations v. 1.5.0
• Azure CIS Foundations v.2.0
• Azure CloudGuard Best Practices
• Azure NIST 800-53 Rev 5
• CloudGuard Azure All Rules Ruleset