Back to Checks
azure

Subscription has an Azure Monitor Activity Log alert for Microsoft.Security/securitySolutions delete operations

monitor_alert_delete_security_solution
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/activitylogalerts

Azure activity log alerts monitor deletions of Security Solutions by targeting the operation Microsoft.Security/securitySolutions/delete at subscription scope.

Identifies whether notifications are configured for security solution removal events.

Prowler logoProwlerprowler-provider-azure

Risk

Without this alert, unauthorized or accidental deletions of security tooling may go unnoticed, reducing the availability of protections and the integrity of monitoring. Adversaries can evade defenses, prolong dwell time, and enable data exfiltration under reduced visibility.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_delete_security_solution

Recommendation

Configure a dedicated activity log alert for Microsoft.Security/securitySolutions/delete and route it to resilient action groups (email, chat, ticketing, SIEM). Apply least privilege and resource locks to deter tampering. Test alerting routinely and integrate it into defense-in-depth monitoring.

Remediation

CLI

az monitor activity-log alert create -g <example_resource_name> -n <example_resource_name> --condition operationName=Microsoft.Security/securitySolutions/delete --scope /subscriptions/<example_resource_id>

Terraform

# Activity Log Alert for Security Solution delete
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_resource_id>"]

  criteria {
    operation_name = "Microsoft.Security/securitySolutions/delete" # Critical: alerts on delete operation
  }
}

NativeIaC

// Activity Log Alert for Security Solution delete
resource alert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'global'
  properties: {
    enabled: true
    scopes: [ subscription().id ]
    condition: {
      allOf: [
        {
          field: 'operationName'
          equals: 'Microsoft.Security/securitySolutions/delete' // Critical: alerts on Security Solution delete
        }
      ]
    }
  }
}

Other

1In Azure portal, go to Monitor > Alerts > + Create > Alert rule
2Scope: Select your subscription and click Apply
3Condition: Click Add condition, search and select "Delete Security Solutions (Microsoft.Security/securitySolutions)", then Add
4Ensure no filters for Level or Status are set
5Details: Enter an Alert rule name and choose a resource group
6Create: Review + create, then Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_delete_security_solution(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Security/securitySolutions/delete"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for deleting Security Solution in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References