Microsoft AzureOverview
Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all HTTP requests are captured and centrally logged.
Rationale
Capturing web requests can provide important supporting information for security analysts performing monitoring and incident response activities. Once logged, these logs can be ingested into SIEM or another central aggregation point for the organization.
Impact
Log consumption and processing will incur additional costs.
Default Value
By default, HTTP logs are not collected
Remediation guidance
Remediate from Azure Portal
- Open the App Service using the
Open in Azurebutton. - Under
Monitoring, go toDiagnostic settings. - To update an existing diagnostic setting, click
Edit settingagainst the setting. To create a new diagnostic setting, clickAdd diagnostic settingand provide a name for the new setting. - Check the checkbox next to
HTTP logs. - Configure a destination based on your specific logging consumption capability (for example, streaming to an event hub and then consuming with SIEM integration for Event Hub logging).
- Click
Save.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure App Services (Sites) without HTTP logging
Connectors
Covered asset types
Expected check: eq []
{
sites(
where: {
diagnosticSettings_SOME: {
logs_SOME: { enabled: false, category: "AppServiceHTTPLogs" }
}
}
) {
...AssetFragment
}
}
