Check ID: monitor_alert_create_update_nsg
Provider: Azure
Service: monitor
Severity: HIGH
Categories: logging
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor Activity Log alert monitors Network Security Group changes via the Microsoft.Network/networkSecurityGroups/write operation to capture create/update events across the subscription

Risk

Lack of alerting on NSG changes allows unauthorized network policy modifications to go unnoticed. Adversaries or mistakes could open ports, reduce segmentation, and enable lateral movement, impacting data confidentiality and service availability through exposure or disruption of critical traffic

Recommendation

Implement a subscription-wide Activity Log alert for NSG change operations and route notifications to an action group for rapid triage. Apply least privilege for change tooling, enforce change management, and add complementary alerts for Microsoft.Network/networkSecurityGroups/securityRules/write and .../delete. Integrate with SIEM for correlation

Remediation

az monitor activity-log alert create --resource-group '<example_resource_name>' --name '<example_resource_name>' --scopes '/subscriptions/<subscription ID>' --condition "category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write" --location global

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_create_update_nsg. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks