Azure Compliance ControlsAzure Monitor
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution
Azure Monitor activity log alert is configured to capture Security Solutions create/update operations (`Microsoft.Security/securitySolutions/write`) at subscription scope. The control checks that an Activity Log Alert exists for Create or Update Security Solution.
What this control checks
Subscription has an Activity Log alert for Microsoft.Security/securitySolutions/write
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- A.8.16 Monitoring activities
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
1 more clause
- 11 Access control
- 7.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 6.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
10 more clauses
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- 5.2.7 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 5.2.7 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 6.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(6)(i) Security incident procedures
Related controls
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled
- Azure subscriptions should have email notifications for high severity alerts enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_alert_create_update_security_solution - Powerpipe Control:
azure_compliance.control.monitor_log_alert_create_update_security_solution - Prowler Check:
monitor_alert_create_update_security_solution - Azure Policy Definition:
3b980d31-7904-4bb7-8575-5665739a8052
Last reviewed: 2026-10-13