AzPolicyAdvertizer

last sync: 2025-Apr-29 17:16:02 UTC

Microsoft Managed Control 1683 - Information System Monitoring | Regulatory Compliance - System and Information Integrity

Azure BuiltIn Policy definition

Source Azure Portal
Display name Microsoft Managed Control 1683 - Information System Monitoring
Id 8c79fee4-88dd-44ce-bbd4-4de88948c4f8
Version 1.0.0
Details on versioning
Versioning Versions supported for Versioning: 0
Built-in Versioning [Preview]
Category Regulatory Compliance
Microsoft Learn
Description Microsoft implements this System and Information Integrity control
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '1.0.0'
Repository: Azure-Policy 8c79fee4-88dd-44ce-bbd4-4de88948c4f8
Additional metadata Name/Id: ACF1683 / Microsoft Managed Control 1683
Category: System and Information Integrity
Title: Information System Monitoring - Attack Detection
Ownership: Customer, Microsoft
Description: The organization: Monitors the information system to detect: Attacks and indicators of potential attacks in accordance with Ensure the proper functioning of internal processes and controls in furtherance of regulatory and compliance requirements; examine system records to confirm that the system is functioning in an optimal, resilient, and secure state; identify irregularities or anomalies that are indicators of a system malfunction or compromise; and Unauthorized local, network, and remote connections;
Requirements: Azure requires service teams to deploy active monitoring solutions that generate audit logs and alerts as a required step in the Security Development Lifecycle (SDL) process, described in the CM family of controls. All service teams upload their logs to Geneva Monitoring, where they are aggregated and processed as described in the AU family of controls. The Logging and Monitoring team assists in identifying normal usage of the system and deviations from that normal range. The tooling automatically reviews audit logs and anti-malware information to confirm that the system is functioning in an optimal, resilient, and secure state and identifies irregularities or anomalies that are indicators of a system malfunction or compromise. Unusual activity is flagged for further review via detections and alerts. Any log event that indicates a potential violation of the Microsoft Security Policy is immediately brought to the attention of Azure Security. Local connections are disallowed by policy within Azure. No personnel have local access. Azure performs network monitoring and detection of unauthorized connections via Network Isolation (NetIso), which provides the Network Risk Management Service (NRMS) for network baseline measurement, management, and enforcement. The service provides an assessment of network security and alerts on internet exposed endpoints via Incident Management (IcM) based on analysis patterns for configuration issues. Any process that begins offering an open network port is flagged and investigated if it is not part of the approved baseline for that host, ensure detection of network services that have not been authorized as an indicator of compromise. In addition, the implemented host-based SDN firewall uses a deny all policy.
Mode Indexed
Type Static
Preview False
Deprecated False
Effect Fixed
audit
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Compliance
The following 1 compliance controls are associated with this Policy definition 'Microsoft Managed Control 1683 - Information System Monitoring' (8c79fee4-88dd-44ce-bbd4-4de88948c4f8)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
NIS2 BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 BR. Backup and Recovery Business continuity and crisis management n/a Directive (EU) 2016/1148 of the European Parliament and the Council (4) aimed to build cybersecurity capabilities across the Union, mitigate threats to network and information systems used to provide essential services in key sectors and ensure the continuity of such services when facing incidents, thus contributing to the Union’s security and to the effective functioning of its economy and society. 25
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Preview]: NIS2 32ff9e30-4725-4ca7-ba3a-904a7721ee87 Regulatory Compliance Preview BuiltIn unknown
History none
JSON compare n/a
JSON
api-version=2021-06-01
EPAC