Ensure that Activity Log Alert exists for Create or Update Network Security Group

Overview

Create an Activity Log Alert for the Create or Update Network Security Group event.

Rationale

Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Default Value

By default, no monitoring alerts are created.

Remediation guidance

Remediate from Azure Portal

Navigate to the Monitor blade.
Select Alerts.
Select Create.
Select Alert rule.
Choose a subscription.
Select Apply.
Select the Condition tab.
Click See all signals.
Select Create or Update Network Security Group (Network Security Group).
Click Apply.
Select the Actions tab.
Click Select action groups to select an existing action group or Create action group to create a new one.
Follow the prompts to choose or create an action group.
Select the Details tab.
Select a Resource group, and provide an Alert rule name and an optional Alert rule description.
Click Review + create.
Click Create.

Remediate from Azure CLI

az monitor activity-log alert create --resource-group "<resource_group_name>" --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope "/subscriptions/<subscription ID>" --name "<activity_log_rule_name>" --subscription <subscription_id> --action-group <action_group_ID>

Remediate from PowerShell

Create the Conditions object.

$conditions = @()
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/networkSecurityGroups/write -Field operationName
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level

Retrieve the Action Group information, store it in a variable, and then create the Actions object.

$actionGroup = Get-AzActionGroup -ResourceGroupName <resource_group_name> -Name <action_group_name>
$actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id

Create the Scope object

$scope = "/subscriptions/<subscription id>"

Create the Activity Log Alert Rule for Microsoft.Network/networkSecurityGroups/write

New-AzActivityLogAlert -Name "<activity_log_alert_rule_name>" -ResourceGroupName "<resource_group_name>" -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription_ID> -Enabled $true

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Activity Log Alert exists for Create or Update Network Security Group

Connectors

Microsoft Azure

Covered asset types

Connector

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.network/networksecuritygroups/write"){...AssetFragment}}