Create a logging and monitoring baseline
Tags: azure, azuresecurity
Published: 2020-04-08 23:05:20

---
title: Create a logging and monitoring baseline
published: true
description: Create a logging and monitoring baseline
tags: #Azure, #AzureSecurity
---
Logging and monitoring are a critical requirement when trying to identify, detect, and mitigate security threats. Having a proper logging policy can ensure you can determine when a security violation has occurred, but also potentially identify the culprit responsible. Azure Activity logs provide data about both external access to a resources and diagnostic logs, which provide information about the operation of that specific resource.

### Ensure that a log profile exists
The Azure Activity Log provides insight into subscription-level events that have occurred in Azure. This includes a range of data, from Azure Resource Manager operational data to updates on Service Health events. The Activity Log was previously known as Audit Logs or Operational Logs, since the Administrative category reports control-plane events for your subscriptions. There is a single Activity Log for each Azure subscription. It provides data about the operations on a resource from the outside. Diagnostic Logs are emitted by a resource and provide information about the operation of that resource. You must enable diagnostic settings for each resource.

1.  In the Azure Portal go to **Monitor**, then select **Activity log**.
2.  Click on **Export to Event Hub**.
3.  Configure the following settings then click **Save**.
      - **Region**: EastUS
      - **Select**: Export to Storage Account
      - **Storage Account**: Select your storage account and click OK
      - **Retention**: 90 days
4.  Select **Save**.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/fufkfdme97hliqxzda67.png)

### Change activity log retention is set to 365 days or more
Setting the Retention (days) to 0 retains the data forever.
1.  Follow the steps listed above. Adjust the Retention days slider bar.

### Create an activity log alert for "Creating, updating, or deleting a Network Security Group" 
By default, no monitoring alerts are created when NSGs are created/updated/deleted. Changing or deleting a security group can allow internal resources to be accessed from improper sources, or for unexpected outbound network traffic.

1.  In to the Azure portal go to **Monitor**, then select **Alerts**.
2.  Select **+ New alert rule**.
3.  In the **Resource** section click **Select**.
4.  Select your subscription and click **Done**.
5.  In the **Condition** section click **Add**.
6.  Search for **Create or Update Network Security Group** and select it.
7.  On the Configure signal logic blade, in the Event initiated by enter **any** and click **Done**.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/1ueh2kv72jmhsn0k85b4.png)
8.  In the **Actions** section click **Create action group**.
9.  On the Add action group blade enter the following details:
      - **Action group name**: NSG Alert
      - **Short name**: NSGAlert
      - **Action  Name**: NSG Alert
      - **Action type**: Email/SMS/Push/Voice
10.  On the **Email/SMS/Push/Voice** blade check the email box and enter your email address and click **OK**.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/sbl3w6h4jzfg765f4wk1.png)
11.  On the Add action group blade click **OK**.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/nbiq1vknuc8ruclpqht8.png)
12.  On the Create rule blade, in the **Alert Details** section enter the following details:
      - **Alert rule name**: NSG Alert
      - **Save to resource group**: myResourceGroup
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/clo7ye455wf5acwr2zha.png)
6.  Click **Create alert rule**