Microsoft Activity Log best practices

Best practice rules for Activity Log

Trend Micro Cloud One™ – Conformity monitors Activity Log with the following rules:

• Create Alert for "Create Policy Assignment" Events

  Ensure that an activity log alert is created for the "Create Policy Assignment" events.

• Create Alert for "Create or Update Load Balancer" Events

  Ensure that an activity log alert is created for "Create or Update Load Balancer" events.

• Create Alert for "Create or Update Public IP Address" Events

  Ensure that activity log alerts are created for the "Create or Update Public IP Address" events.

• Create Alert for "Create or Update Security Solution" Events

  Ensure that an activity log alert is created for the "Create/Update Security Solution" events.

• Create Alert for "Create or Update Virtual Machine" Events

  Ensure that an activity log alert is created for "Create or Update Virtual Machine (Microsoft.Compute/virtualMachines)" events.

• Create Alert for "Create, Update or Delete SQL Server Firewall Rule" Events

  Ensure that an activity log alert is created for the “Create/Update/Delete SQL Server Firewall Rule” events.

• Create Alert for "Create/Update Azure SQL Database" Events

  Ensure that an activity log alert is created for "Create/Update Azure SQL Database" events.

• Create Alert for "Create/Update Network Security Group" Events

  Ensure that an activity log alert is created for the "Create/Update Network Security Group" events.

• Create Alert for "Create/Update Storage Account" Events

  Ensure there is an activity log alert created for the "Create/Update Storage Account" events.

• Create Alert for "Deallocate Virtual Machine" Events

  Ensure that an activity log alert is created for the "Deallocate Virtual Machine (Microsoft.Compute/virtualMachines)" events.

• Create Alert for "Delete Azure SQL Database" Events

  Ensure that an activity log alert is created for "Delete Azure SQL Database (Microsoft.Sql/servers/databases)" events.

• Create Alert for "Delete Key Vault" Events

  Ensure there is an activity log alert created for the "Delete Key Vault" events.

• Create Alert for "Delete Load Balancer" Events

  Ensure there is an Azure activity log alert created for "Delete Load Balancer" events.

• Create Alert for "Delete Network Security Group Rule" Events

  Ensure that an activity log alert is created for the "Delete Network Security Group Rule" events.

• Create Alert for "Delete Network Security Group" Events

  Ensure that an activity log alert is created for the "Delete Network Security Group" events.

• Create Alert for "Delete Policy Assignment" Events

  Ensure that an activity log alert is created for the "Delete Policy Assignment" events.

• Create Alert for "Delete Public IP Address" Events

  Ensure that activity log alerts are created for the "Delete Public IP Address" events.

• Create Alert for "Delete Security Solution" Events

  Ensure that an activity log alert is created for the "Delete Security Solution" events.

• Create Alert for "Delete Storage Account" Events

  Ensure that an activity log alert exists for "Delete Storage Account" events.

• Create Alert for "Delete Virtual Machine" Events

  Ensure that an activity log alert exists for "Delete Virtual Machine" events.

• Create Alert for "Power Off Virtual Machine" Events

  Ensure that an activity log alert exists for "Power Off Virtual Machine" events.

• Create Alert for "Rename Azure SQL Database" Events

  Ensure that an activity log alert is created for "Rename Azure SQL Database" events.

• Create Alert for "Update Key Vault" Events

  Ensure that an activity log alert is created for "Update Key Vault (Microsoft.KeyVault/vaults)" events.

• Create Alert for "Update Security Policy" Events

  Ensure that an activity log alert is created for the "Update Security Policy" events.

• Create Alert for “Create/Update MySQL Database” Events

  Ensure that an activity log alert is created for “Create/Update MySQL Database” events.

• Create Alert for “Create/Update Network Security Group Rule” Events

  Ensure that an activity log alert is created for the “Create/Update Network Security Group Rule” events.

• Create Alert for “Create/Update PostgreSQL Database” Events

  Ensure that an activity log alert is created for “Create/Update PostgreSQL Database” events.

• Create Alert for “Delete MySQL Database” Events

  Ensure that an activity log alert is created for “Delete MySQL Database” events.

• Create Alert for “Delete PostgreSQL Database” Events

  Ensure that an activity log alert is created for “Delete PostgreSQL Database” events.