Benchmark: 5.1 Configuring Diagnostic Settings
The Azure Diagnostic Settings capture control/management activities performed on a subscription. By default, the Azure Portal retains activity logs only for 90 days. The Diagnostic Settings define the type of events that are stored or streamed and the outputs— storage account and/or event hub. The Diagnostic Settings, if configured properly, can ensure that all activity logs are retained for longer duration. This section has recommendations for correctly configuring the Diagnostic Settings so that all activity logs captured are retained for longer periods.
When configuring Diagnostic Settings you may choose to export in one of three ways in which you need to ensure appropriate data retention. The options are Log Analytics, Event Hub, and a Storage Account. It is important to ensure you are aware and have set retention as your organization sees fit.
steampipe check azure_compliance.benchmark.cis_v130_5_1
- 5.1.1 Ensure that a 'Diagnostics Setting' exists
- 5.1.2 Ensure Diagnostic Setting captures appropriate categories
- 5.1.3 Ensure the storage container storing the activity logs is not publicly accessible
- 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key)
- 5.1.5 Ensure that logging for Azure KeyVault is 'Enabled'