Skip to content

Azure logging & audit security checks

Audit logs, event retention and incident-response hooks — the evidence you need when something goes wrong, and the controls auditors ask for first.

On Azure, Black Cat runs 13 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Azure connector needs.

Checks (13)

severity: high NSG Flow Logs Disabled fix difficulty: easy #

Enable NSG flow logs to capture network traffic metadata for security analysis

  1. Navigate to the Azure Portal and open Network Watcher
  2. Click NSG flow logs in the left menu
  3. Click Add and select the flagged NSG from the dropdown
  4. Choose a storage account for log retention and set retention to at least 90 days
  5. Optionally enable Traffic Analytics for enhanced insights
  6. Click Save and verify the flow log status shows Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Key Vault Diagnostic Logging Disabled fix difficulty: medium #

Enable diagnostic settings on the Key Vault to capture audit and request logs

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Diagnostic settings under Monitoring
  3. Click Add diagnostic setting
  4. Select AuditEvent and AllMetrics log categories
  5. Choose a destination (Log Analytics workspace or Storage account) for log storage
  6. Click Save and verify the diagnostic setting appears in the list

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high SQL Auditing Disabled fix difficulty: easy #

Enable auditing on the Azure SQL Server to log all database events

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Auditing under Security
  3. Toggle Auditing to On
  4. Choose a storage destination (Storage account, Log Analytics, or Event Hub)
  5. Set the retention period to at least 90 days
  6. Click Save and verify the auditing status shows Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium SQL Audit Retention Short fix difficulty: easy #

Extend the SQL Server audit log retention period to at least 90 days

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Auditing under Security
  3. Verify auditing is enabled and click the storage account destination link
  4. In the storage account settings, set Retention (days) to 90 or higher
  5. Click Save on the auditing configuration page
  6. Verify the retention period is reflected in the auditing settings

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high App Service Logging Disabled fix difficulty: easy #

Enable application and HTTP logging on the App Service

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click App Service logs under Monitoring
  3. Set Application logging (Filesystem) to On and choose a level (e.g. Warning or Error)
  4. Enable Web server logging and set a retention period of at least 30 days
  5. Optionally enable Detailed error messages and Failed request tracing
  6. Click Save and verify logs are being written by checking the Log stream

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Diagnostic Retention Short fix difficulty: easy #

Set the diagnostic setting log retention period to at least 365 days

  1. Navigate to the Azure Portal and open Monitor
  2. Click Diagnostic settings in the left menu
  3. Select the resource with the short retention setting
  4. Click Edit setting next to the existing diagnostic setting
  5. Under the storage account destination, set Retention (days) to 365 or higher
  6. Click Save to apply the updated retention policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert Policy Assignment Missing fix difficulty: medium #

Create an activity log alert for Azure Policy assignment create and update operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Create policy assignment (Microsoft.Authorization/policyAssignments/write)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert NSG Create Missing fix difficulty: medium #

Create an activity log alert for NSG create and update operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Create or Update Network Security Group (Microsoft.Network/networkSecurityGroups/write)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert NSG Delete Missing fix difficulty: medium #

Create an activity log alert for NSG delete operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Delete Network Security Group (Microsoft.Network/networkSecurityGroups/delete)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert Security Solution Create Missing fix difficulty: medium #

Create an activity log alert for security solution create and update operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Create or Update Security Solution (Microsoft.Security/securitySolutions/write)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert Security Solution Delete Missing fix difficulty: medium #

Create an activity log alert for security solution delete operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Delete Security Solution (Microsoft.Security/securitySolutions/delete)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert SQL Firewall Missing fix difficulty: medium #

Create an activity log alert for SQL Server firewall rule create, update, and delete operations

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts and then Create an alert rule
  3. Click Select condition and search for Create or Update Server Firewall Rule (Microsoft.Sql/servers/firewallRules/write)
  4. Configure the scope to the subscription level
  5. Add an action group with email or webhook notification
  6. Name the alert rule and click Create alert rule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Alert Disabled fix difficulty: easy #

Enable the disabled activity log alert rule so it fires on matching events

  1. Navigate to the Azure Portal and open Monitor
  2. Click Alerts in the left menu and then Alert rules
  3. Filter to show disabled rules and locate the flagged alert rule
  4. Click the alert rule name to open its details
  5. Click Edit and set the Status toggle to Enabled
  6. Click Save and verify the alert rule status shows as Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

More Azure checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial