AzPolicyAdvertizer

last sync: 2025-Apr-29 17:16:02 UTC

Microsoft Managed Control 1684 - Information System Monitoring | Regulatory Compliance - System and Information Integrity

Azure BuiltIn Policy definition

Source Azure Portal
Display name Microsoft Managed Control 1684 - Information System Monitoring
Id 16bfdb59-db38-47a5-88a9-2e9371a638cf
Version 1.0.0
Details on versioning
Versioning Versions supported for Versioning: 0
Built-in Versioning [Preview]
Category Regulatory Compliance
Microsoft Learn
Description Microsoft implements this System and Information Integrity control
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '1.0.0'
Repository: Azure-Policy 16bfdb59-db38-47a5-88a9-2e9371a638cf
Additional metadata Name/Id: ACF1684 / Microsoft Managed Control 1684
Category: System and Information Integrity
Title: Information System Monitoring - Unauthorized Use
Ownership: Customer, Microsoft
Description: The organization: Identifies unauthorized use of the information system through Microsoft Azure SLAM (Security Logging and Auditing) and C+AI Security logging and monitoring;
Requirements: Due to the size and complexity of the Azure environment, Azure utilizes event forwarding and monitoring tools to record events across Azure and correlate the events gathered by each logging tool. Log review cannot be conducted manually in the Azure environment due to the high volume of events. Instead, Azure implements automated methods to perform review, analysis, and reporting of logs. Azure Security Monitoring (ASM) and Scuba are used to do direct alerting using IcM tickets on security-relevant events. These tools utilize event audit policies and detections that report events to the Microsoft Operations Center (MOC), Security Response Team, and service teams, as appropriate. The policies are tuned to alert on events of immediate concern. Events that need little or no correlation to prompt a preliminary investigation and attention of Security Response Team personnel. Once processed, the Security Response Team reviews and analyzes alerts generated by the automated review of audit records in real time, specifically in the case of a security incident, customer request or escalation, or any other functionality impacting the incident in production. Groups of these correlated events that meet a pattern of a known attack methodology are collected and delivered to personnel via IcM or email. Personnel correlate alerts, collect multiple similar alarms, and append them to tickets for review and analysis. The alerting system provides response capability twenty-four (24) hours a day, seven (7) days a week. Troubleshooting Guides (TSGs) applied to workflow tickets provide instructions for the escalation of certain events to response personnel.
Mode Indexed
Type Static
Preview False
Deprecated False
Effect Fixed
audit
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Compliance
The following 1 compliance controls are associated with this Policy definition 'Microsoft Managed Control 1684 - Information System Monitoring' (16bfdb59-db38-47a5-88a9-2e9371a638cf)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
NIS2 BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 BR. Backup and Recovery Business continuity and crisis management n/a Directive (EU) 2016/1148 of the European Parliament and the Council (4) aimed to build cybersecurity capabilities across the Union, mitigate threats to network and information systems used to provide essential services in key sectors and ensure the continuity of such services when facing incidents, thus contributing to the Union’s security and to the effective functioning of its economy and society. 25
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Preview]: NIS2 32ff9e30-4725-4ca7-ba3a-904a7721ee87 Regulatory Compliance Preview BuiltIn unknown
History none
JSON compare n/a
JSON
api-version=2021-06-01
EPAC