Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
monitor_alert_delete_security_solutionProvider: Azure
Service:
monitorSeverity: MEDIUM
Categories:
loggingResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure activity log alerts monitor deletions of Security Solutions by targeting the operationMicrosoft.Security/securitySolutions/delete at subscription scope.
Identifies whether notifications are configured for security solution removal events.
Risk
Without this alert, unauthorized or accidental deletions of security tooling may go unnoticed, reducing the availability of protections and the integrity of monitoring. Adversaries can evade defenses, prolong dwell time, and enable data exfiltration under reduced visibility.Recommendation
Configure a dedicated activity log alert forMicrosoft.Security/securitySolutions/delete and route it to resilient action groups (email, chat, ticketing, SIEM). Apply least privilege and resource locks to deter tampering. Test alerting routinely and integrate it into defense-in-depth monitoring.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/delete-security-solution-alert.html
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
- https://learn.microsoft.com/en-us/cli/azure/monitor/activity-log/alert?view=azure-cli-latest
- https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_delete_security_solution. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks