Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
monitor_alert_create_update_nsgProvider: Azure
Service:
monitorSeverity: HIGH
Categories:
loggingResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor Activity Log alert monitors Network Security Group changes via theMicrosoft.Network/networkSecurityGroups/write operation to capture create/update events across the subscription
Risk
Lack of alerting on NSG changes allows unauthorized network policy modifications to go unnoticed. Adversaries or mistakes could open ports, reduce segmentation, and enable lateral movement, impacting data confidentiality and service availability through exposure or disruption of critical trafficRecommendation
Implement a subscription-wide Activity Log alert for NSG change operations and route notifications to an action group for rapid triage. Apply least privilege for change tooling, enforce change management, and add complementary alerts forMicrosoft.Network/networkSecurityGroups/securityRules/write and .../delete. Integrate with SIEM for correlation
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
- https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/create-update-network-security-group-rule-alert-in-use.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_create_update_nsg. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks