Back to Checks
azure

Subscription has Activity Log alert for Security Solution create or update

monitor_alert_create_update_security_solution
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor activity log alert is configured to capture Security Solutions create/update operations (Microsoft.Security/securitySolutions/write) at subscription scope.

Prowler logoProwlerprowler-provider-azure

Risk

Without this alert, unauthorized or mistaken changes to security tooling can go undetected. Attackers could disable defenses, alter integrations, or weaken policies, eroding the integrity of controls, creating blind spots that threaten confidentiality, and delaying incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_create_update_security_solution

Recommendation

Configure an activity log alert for Microsoft.Security/securitySolutions/write and route it to action groups for prompt notification/automation.

Apply least privilege, require change control, and forward alerts to a central SIEM to strengthen defense in depth.

Remediation

CLI

az monitor activity-log alert create --name "<activity log rule name>" --resource-group "<example_resource_name>" --scopes "/subscriptions/<example_resource_id>" --condition "category=Administrative and operationName=Microsoft.Security/securitySolutions/write" --location Global

Terraform

# Activity Log Alert for Security Solution create/update
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_resource_id>"]

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Security/securitySolutions/write" # Critical: fires on Security Solution create/update
  }
}

NativeIaC

// Activity Log Alert for Security Solution create/update
resource activityLogAlert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'Global'
  properties: {
    scopes: [ '/subscriptions/<example_resource_id>' ]
    condition: {
      allOf: [
        {
          field: 'category'
          equals: 'Administrative'
        }
        {
          field: 'operationName' // Critical: match Security Solution create/update
          equals: 'Microsoft.Security/securitySolutions/write' // Triggers on this operation
        }
      ]
    }
    enabled: true
  }
}

Other

1In the Azure portal, go to Monitor > Alerts > + Create > Alert rule
2Scope: Select your Subscription and click Apply
3Condition: Choose Activity log, set Signal name to Administrative, then add a filter Operation name = Microsoft.Security/securitySolutions/write
4Actions: Skip (no action group required)
5Details: Enter a Name, set Region to Global, ensure Enable alert rule upon creation is checked
6Review + create > Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_create_update_security_solution(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Security/securitySolutions/write"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for creating/updating Security Solution in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References