ASSOCIATED DRATA CONTROL
This test is part of DCF-406, DCF-407, and DCF-86. The Audit Logging control (DCF-406) that ensures audit logs are enabled and active for all system components and sensitive data in accordance with company policies. The System Monitoring control (DCF-86) ensures production systems and resources are monitored and automated alerts are sent out to personnel based on pre-configured rules. Events are triaged to determine if they constitute an incident and escalated per policy if necessary.
WHAT TO DO IF A TEST FAILS
If Drata finds that an activity log alert for the 'Create or Update SQL Server Firewall Rule' event does not exist in Azure, the test will fail.
STEPS TO REMEDIATE
Navigate to the 'Monitor' blade.
Select 'Alerts' > 'Create' > 'Alert rule'.
Choose a subscription and select 'Apply'.
Select the 'Condition' tab and click 'See all signals'.
Select 'Create/Update server firewall rule (Server Firewall Rule)' and click 'Apply'.
Select the 'Actions' tab and click 'Select action groups' to select an existing action group, or 'Create action group' to create a new action group. Then follow the prompts to choose or create an action group.
Select the 'Details' tab.
Select a 'Resource group,' provide an 'Alert rule name' and an optional 'Alert rule description'.
Click 'Review + create' and then click 'Create'.
Center for Internet Security (CIS)
This is a test that aligns with the Center for Internet Security’s (CIS) benchmarks for Microsoft Azure, providing prescriptive guidance to establish a secure baseline configuration for Azure environments. These benchmarks are developed through a global, consensus-driven process involving cybersecurity experts to help organizations strengthen their defenses against potential threats in the cloud.