Turbot Guardrails Hub 
Hub
  • Mods
  • Policy Packs
  • Docs
  • Home
ModsPolicy PacksDocsHome
Mods
Azure
Loading policies...

Policy: Azure > CIS v4.0 > 07 - Management and Governance > 07.01 - Logging and Monitoring > 07.01.01 - Configuring Diagnostic Settings

The Azure Diagnostic Settings capture control/management activities performed on a subscription or Azure AD Tenant. By default, the Azure Portal retains activity logs only for 90 days. The Diagnostic Settings define the type of events that are stored or streamed and the outputs—storage account, log analytics workspace, event hub, and others. The Diagnostic Settings, if configured properly, can ensure that all logs are retained for longer duration. This section has recommendations for correctly configuring the Diagnostic Settings so that all logs captured are retained for longer periods.

Primary Policy

This policy is used with the following primary policy:

  • Azure > CIS v4.0 > 07 - Management and Governance > 07.01 - Logging and Monitoring

Related Policies

  • 07.01.01.01 - Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
  • 07.01.01.02 - Ensure Diagnostic Setting captures appropriate categories
  • 07.01.01.03 - Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK)
  • 07.01.01.04 - Ensure that logging for Azure Key Vault is 'Enabled'
  • 07.01.01.05 - Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
  • 07.01.01.06 - Ensure that logging for Azure AppService 'HTTP logs' is enabled
  • 07.01.01.07 - Ensure that virtual network flow logs are captured and sent to Log Analytics
  • 07.01.01.08 - Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Graph activity logs to an appropriate destination
  • 07.01.01.09 - Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Entra activity logs to an appropriate destination
  • 07.01.01.10 - Ensure that Intune logs are captured and sent to Log Analytics

Policy Specification

Schema Type
string
Default
Per Azure > CIS v4.0 > 07 - Management and Governance > 07.01 - Logging and Monitoring
Valid Values [YAML]
  • >-
  Per Azure > CIS v4.0 > 07 - Management and Governance > 07.01 - Logging and
  Monitoring

  • Skip

  • Check: All CIS Benchmarks except attestations

  • Check: All CIS Benchmarks
Examples [YAML]
  • Skip

Category

  • CIS

In Your Workspace

  • Policy Settings by Type report

Developers

    Category URI
    • tmod:@turbot/cis#/control/categories/cis
    • Policy Type URI
    • tmod:@turbot/azure-cisv4-0#/policy/types/s070101
    • GraphQL
    • query policyType(id: "tmod:@turbot/azure-cisv4-0#/policy/types/s070101") { … }
    • query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/s070101'") { … }
    • query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/s070101'") { … }
    • CLI
    • Get Policy Type
    • turbot graphql policy-type --id "tmod:@turbot/azure-cisv4-0#/policy/types/s070101"
      • Get Policy Settings
    • turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv4-0#/policy/types/s070101"
Guardrails
Guardrails Hub
  • Hub
  • Docs
  • Blog
  • Changelog
Products
  • GuardrailsGuardrails
  • PipesPipes
  • SteampipeSteampipe
  • PowerpipePowerpipe
  • FlowpipeFlowpipe
  • TailpipeTailpipe
Turbot
  • Home
  • About us
  • We're hiring!
  • Contact us
Community

Our community of practitioners love to discuss cloud governance & security.

Slack logoJoin us on Slack →

System StatusLegalSecurity
Terms of UseSecurityPrivacy
50
Mods
207
Resource Types
3,612
Policies
1,957
Controls
103
Quick Actions
114
IAM