azure-monitor-audit
starsforks
How to install azure-monitor-audit?
bagelhole/devops-security-agent-skills/azure-monitor-audit
$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill azure-monitor-auditConfigure Azure Monitor and Activity Log for auditing. Set up diagnostic settings and log analytics. Use when auditing Azure activity.
SKILL.md
| 1 | # Azure Monitor Audit |
| 2 | |
| 3 | Audit Azure activity with Monitor, Activity Logs, and Log Analytics for compliance, security, and operational visibility. |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Enabling centralized audit logging across Azure subscriptions |
| 8 | - Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or ISO 27001 |
| 9 | - Investigating security incidents or unauthorized activity in Azure |
| 10 | - Setting up alerting on administrative and security events |
| 11 | - Building compliance dashboards and automated evidence collection |
| 12 | |
| 13 | ## Create Log Analytics Workspace |
| 14 | |
| 15 | ```bash |
| 16 | # Create resource group for audit resources |
| 17 | az group create \ |
| 18 | --name rg-audit \ |
| 19 | --location eastus |
| 20 | |
| 21 | # Create Log Analytics workspace |
| 22 | az monitor log-analytics workspace create \ |
| 23 | --resource-group rg-audit \ |
| 24 | --workspace-name audit-workspace \ |
| 25 | --location eastus \ |
| 26 | --retention-time 365 \ |
| 27 | --sku PerGB2018 |
| 28 | |
| 29 | # Get workspace ID for later use |
| 30 | WORKSPACE_ID=$(az monitor log-analytics workspace show \ |
| 31 | --resource-group rg-audit \ |
| 32 | --workspace-name audit-workspace \ |
| 33 | --query id -o tsv) |
| 34 | |
| 35 | # Enable audit solutions |
| 36 | az monitor log-analytics solution create \ |
| 37 | --resource-group rg-audit \ |
| 38 | --solution-type SecurityCenterFree \ |
| 39 | --workspace audit-workspace |
| 40 | ``` |
| 41 | |
| 42 | ## Configure Diagnostic Settings for Subscription Activity Log |
| 43 | |
| 44 | ```bash |
| 45 | # Export subscription activity log to Log Analytics |
| 46 | az monitor diagnostic-settings subscription create \ |
| 47 | --name activity-log-to-workspace \ |
| 48 | --location global \ |
| 49 | --workspace "$WORKSPACE_ID" \ |
| 50 | --logs '[ |
| 51 | {"category": "Administrative", "enabled": true}, |
| 52 | {"category": "Security", "enabled": true}, |
| 53 | {"category": "ServiceHealth", "enabled": true}, |
| 54 | {"category": "Alert", "enabled": true}, |
| 55 | {"category": "Recommendation", "enabled": true}, |
| 56 | {"category": "Policy", "enabled": true}, |
| 57 | {"category": "Autoscale", "enabled": true}, |
| 58 | {"category": "ResourceHealth", "enabled": true} |
| 59 | ]' |
| 60 | |
| 61 | # Also archive to storage account for long-term retention |
| 62 | az storage account create \ |
| 63 | --name auditlogsarchive \ |
| 64 | --resource-group rg-audit \ |
| 65 | --location eastus \ |
| 66 | --sku Standard_GRS \ |
| 67 | --kind StorageV2 \ |
| 68 | --min-tls-version TLS1_2 \ |
| 69 | --allow-blob-public-access false |
| 70 | |
| 71 | az monitor diagnostic-settings subscription create \ |
| 72 | --name activity-log-to-storage \ |
| 73 | --location global \ |
| 74 | --storage-account /subscriptions/{sub}/resourceGroups/rg-audit/providers/Microsoft.Storage/storageAccounts/auditlogsarchive \ |
| 75 | --logs '[ |
| 76 | {"category": "Administrative", "enabled": true, "retentionPolicy": {"enabled": true, "days": 2555}}, |
| 77 | {"category": "Security", "enabled": true, "retentionPolicy": {"enabled": true, "days": 2555}} |
| 78 | ]' |
| 79 | ``` |
| 80 | |
| 81 | ## Resource-Level Diagnostic Settings |
| 82 | |
| 83 | ```bash |
| 84 | # Enable diagnostics for Azure Key Vault |
| 85 | az monitor diagnostic-settings create \ |
| 86 | --name keyvault-audit \ |
| 87 | --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vault} \ |
| 88 | --workspace "$WORKSPACE_ID" \ |
| 89 | --logs '[ |
| 90 | {"category": "AuditEvent", "enabled": true, "retentionPolicy": {"enabled": true, "days": 365}}, |
| 91 | {"category": "AzurePolicyEvaluationDetails", "enabled": true} |
| 92 | ]' \ |
| 93 | --metrics '[ |
| 94 | {"category": "AllMetrics", "enabled": true} |
| 95 | ]' |
| 96 | |
| 97 | # Enable diagnostics for Azure SQL Database |
| 98 | az monitor diagnostic-settings create \ |
| 99 | --name sql-audit \ |
| 100 | --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Sql/servers/{server}/databases/{db} \ |
| 101 | --workspace "$WORKSPACE_ID" \ |
| 102 | --logs '[ |
| 103 | {"category": "SQLSecurityAuditEvents", "enabled": true}, |
| 104 | {"category": "SQLInsights", "enabled": true}, |
| 105 | {"category": "AutomaticTuning", "enabled": true} |
| 106 | ]' |
| 107 | |
| 108 | # Enable diagnostics for Azure App Service |
| 109 | az monitor diagnostic-settings create \ |
| 110 | --name appservice-audit \ |
| 111 | --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app} \ |
| 112 | --workspace "$WORKSPACE_ID" \ |
| 113 | --logs '[ |
| 114 | {"category": "AppServiceHTTPLogs", "enabled": true}, |
| 115 | {"category": "AppServiceAuditLogs", "enabled": true}, |
| 116 | {"category": "AppServiceIPSecAuditLogs", "enabled": true}, |
| 117 | {"category": "AppServicePlatformLogs", "enabled": true} |
| 118 | ]' |
| 119 | |
| 120 | # Enable diagnostics for Network Security Groups |
| 121 | az monitor diagnostic-settings create \ |
| 122 | --name nsg-flow-logs \ |
| 123 | --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/networkSecurityGroups/{nsg} \ |
| 124 | --workspace "$WORKSPACE_ID" \ |
| 125 | --logs '[ |
| 126 | {"category": "NetworkSecurityGroupEvent", "enabled": true}, |
| 127 | {"category": "NetworkSecurityGroupRuleCounter", "enabled": true} |
| 128 | ]' |
| 129 | ``` |
| 130 | |
| 131 | ## Azure Policy for Diagnostic Settings Enforcement |
| 132 | |
| 133 | ```bash |
| 134 | # Assign built-in policy to require diagnostic settings on Key Vaults |
| 135 | az policy assignment create \ |
| 136 | --name require-kv-diagnostics \ |
| 137 | --policy "951af2fa-529b-416e-ab6e-066fd85ac459" \ |
| 138 | --scope |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
