lacework-global-553
5.3 Enable Azure Monitor Resource Logging for All Services that Support it (Manual)
Profile Applicability
• Level 1
Description
Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.
A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, best practices recommend a minimum retention period of two years.
Rationale
A lack of monitoring reduces the visibility into the data plane, and therefore an organization's ability to detect reconnaissance, authorization attempts or other malicious activity. Unlike Activity Logs, Resource Logs are not enabled by default. Specifically, without monitoring it would be impossible to tell which entities had accessed a data store that was breached. In addition, alerts for failed attempts to access APIs for Web Services or Databases are only possible when logging is enabled.
Impact
Costs for monitoring varies with Log Volume. Not every resource needs to have logging enabled. It is important to determine the security classification of the data being processed by the given resource and adjust the logging based on which events need to be tracked. This is typically determined by governance and compliance requirements.
Audit
From Azure Portal
The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:
- Go to the resource
- Click on Diagnostic settings
- In the blade that appears, click "Add diagnostic setting"
- Configure the diagnostic settings
- Click on Save
Remediation
Azure Subscriptions should log every access and operation for all resources. You should send logs to Storage and a Log Analytics Workspace or equivalent third-party system. Keep logs in readily accessible storage for a minimum of one year, and then move to inexpensive cold storage for a duration of time as necessary.
If retention policies exist, but it is not possible to store logs in a Storage Account (for example, if you only select the Event Hubs or Log Analytics options), the retention policies have no effect. Enable all monitoring at first, and then be more aggressive moving data to cold storage if the volume of data becomes a cost concern.
From Azure Portal
The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are:
- Go to the resource.
- Click Diagnostic settings.
- In the blade that appears, click "Add diagnostic setting".
- Configure the diagnostic settings.
- Click Save.
References
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-5-centralize-security-log-management-and-analysis
https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/monitor-azure-resource
Supported Log Categories
https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-categories
Logs and Audit - Fundamentals
https://docs.microsoft.com/en-us/azure/security/fundamentals/log-audit
Collecting Logs
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/collect-activity-logs
Key Vault Logging
https://docs.microsoft.com/en-us/azure/key-vault/key-vault-logging
Monitor Diagnostic Settings
https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest
Overview of Diagnostic Logs
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-logs-overview
Supported Services for Diagnostic Logs
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-logs-schema
Diagnostic Logs for CDNs
https://docs.microsoft.com/en-us/azure/cdn/cdn-azure-diagnostic-logs
Additional Information
Note: The Center for Internet Security (CIS) Benchmark covers some specific Diagnostic Logs separately.
Section 3 - Storage Accounts: Enable Storage Logging for Queue Service for 'Read', 'Write', and 'Delete' requests (lacework-global-616).
Section 6 - Network: Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (lacework-global-633).
For an up-to-date list of Azure resources which support Azure Monitor, refer to the "Supported Log Categories" reference.