Control: Azure > CIS v2.0 > 05 - Logging and Monitoring > 5.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
Configures auditing against a CIS Benchmark item.
Level: 1
Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type. A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
Resource Types
This control targets the following resource types:
Primary Policies
The following policies can be used to configure this control:
- 5.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- 5.04 - Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it > Attestation
Category
In Your Workspace
Developers
- tmod:@turbot/azure-cisv2-0#/control/types/r0504
- tmod:@turbot/cis#/control/categories/v070605
- turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv2-0#/control/types/r0504"
Get Controls