standard
turbot/azure_cis
Get Involved
Version
Pipeline: 6.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled
Description
Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all http requests are captured and centrally logged.
Capturing web requests can be important supporting information for security analysts performing monitoring and incident response activities. Once logging, these logs can be ingested into SIEM or other central aggregation point for the organization.
Remediation
From Azure Portal
- Go to
App Services
.
For each App Service
:
- Under
Monitoring
, go toDiagnostic settings
. - To update an existing diagnostic setting, click
Edit setting
against the setting. To create a new diagnostic setting, clickAdd diagnostic setting
and provide a name for the new setting. - Check the checkbox next to
HTTP logs
. - Configure a destination based on your specific logging consumption capability (for example Stream to an event hub and then consuming with SIEM integration for Event Hub logging).
- Click
Save
.
Default Value
Not configured.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run azure_cis.pipeline.cis_v300_6_1_6
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = azure_cis.pipeline.cis_v300_6_1_6 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
approvers | list(notifier) | Yes | List of notifiers to be used for obtaining action/approval decisions. | notifier.default |
Outputs
This pipeline has no outputs.
Tags
folder = CIS v3.0.0/6 Logging and Monitoring/6.1 Configuring Diagnostic Settings