AzPolicyAdvertizer

last sync: 2021-Sep-22 19:36:51 UTC

Azure Policy definition

An activity log alert should exist for specific Policy operations

Name An activity log alert should exist for specific Policy operations
Azure Portal
Id c5447c04-a4d7-4ba8-a263-c9ee321a6858
Version 3.0.0
details on versioning
Category Monitoring
Microsoft docs
Description This policy audits specific Policy operations with no activity log alerts configured.
Mode All
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: AuditIfNotExists
Allowed: (AuditIfNotExists, Disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2020-10-27 14:12:45 change Major (2.0.0 > 3.0.0)
2020-01-29 21:53:30 add c5447c04-a4d7-4ba8-a263-c9ee321a6858
Used in Initiatives
Initiative DisplayName Initiative Id Initiative Category State
[Preview]: CMMC Level 3 b5629c75-5c77-4422-87b9-2509e680f8de Regulatory Compliance Preview
CIS Microsoft Azure Foundations Benchmark v1.1.0 1a5bb27d-173f-493e-9568-eb56638dde4d Regulatory Compliance GA
CIS Microsoft Azure Foundations Benchmark v1.3.0 612b5213-9160-4969-8578-1518bd2a000c Regulatory Compliance GA
CIS Microsoft Azure Foundations Benchmark v1.3.0 612b5213-9160-4969-8578-1518bd2a000c Regulatory Compliance GA
JSON Changes

JSON 
{
  "displayName": "An activity log alert should exist for specific Policy operations",
  "policyType": "BuiltIn",
  "mode": "All",
  "description": "This policy audits specific Policy operations with no activity log alerts configured.",
  "metadata": {
    "version": "3.0.0",
    "category": "Monitoring"
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": [
        "AuditIfNotExists",
        "Disabled"
      ],
      "defaultValue": "AuditIfNotExists"
    },
    "operationName": {
      "type": "String",
      "metadata": {
        "displayName": "Operation Name",
        "description": "Policy Operation name for which activity log alert should exist"
      },
      "allowedValues": [
        "Microsoft.Authorization/policyAssignments/write",
        "Microsoft.Authorization/policyAssignments/delete"
      ]
    }
  },
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions"
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]",
      "details": {
        "type": "Microsoft.Insights/ActivityLogAlerts",
        "existenceCondition": {
          "allOf": [
            {
              "field": "Microsoft.Insights/ActivityLogAlerts/enabled",
              "equals": "true"
            },
            {
              "count": {
                "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]",
                "where": {
                  "anyOf": [
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                          "equals": "category"
                        },
                        {
                          "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                          "equals": "Administrative"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                          "equals": "operationName"
                        },
                        {
                          "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
                          "equals": "[parameters('operationName')]"
                        }
                      ]
                    }
                  ]
                }
              },
              "equals": 2
            },
            {
              "not": {
                "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                "equals": "category"
              }
            },
            {
              "not": {
                "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field",
                "equals": "operationName"
              }
            }
          ]
        }
      }
    }
  }
}