Azure subscriptions should have an Activity Log alert for Service Health incidents
Checks that an Azure Monitor Activity Log alert exists for Service Health notifications, where `category` equals `ServiceHealth` and `properties.incidentType` equals `Incident`, and that the alert rule is enabled in the subscription.
Without alerts for Service Health incidents, teams may miss Azure outages or degradations, harming availability and delaying failover. Unseen incidents can cause cascading errors, timeouts, deployment failures, and SLA breaches across dependent workloads.
What this control checks
Enabled Activity Log alert with category ServiceHealth and properties.incidentType Incident.
Audit evidence
Evidence that deployed resources meet this control: Prowler check monitor_alert_service_health_exists (prowler azure --checks monitor_alert_service_health_exists).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 7.1.2.11 (Ensure that an Activity Log Alert exists for Service Health).
CIS Azure Benchmark v5.0.0: Mapped to 6.1.2.11 (Ensure that an Activity Log Alert exists for Service Health).
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-7-4 (Annex I (7.4) - Implement appropriate (e.g. centralised) systems and controls to allow, manage, log and monitor...).
BSI C5:2025: Mapped to AM-09.03AC (Logging and monitoring applications take the asset protection needs into account in order to inform the responsible...), AM-09.04AC (Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need...), HR-03.02AC (Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.) and 14 more clauses.
HIPAA Security Rule 2003: Mapped to 164.308(a)(6)(i) (Security incident procedures).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.1.2.11 Ensure that an Activity Log Alert exists for Service Health
- 6.1.2.11 Ensure that an Activity Log Alert exists for Service Health
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
12 more clauses
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
- OIS-08.08B The cloud service provider prioritises the risk treatment according to the level of cyber risks related to the cloud service.
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- 164.308(a)(6)(i) Security incident procedures
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_monitor_alert_service_health_exists - Prowler Check:
monitor_alert_service_health_exists
Last reviewed: 2026-10-11