Azure / Azure/PSRule.Rules.Azure

Diagnostic logs in Event Hub should be enabled

Open
#1,863 0 comments 0 reactions 0 assignees View on GitHub
pillar: security rule: event-hub
Dominant language
PowerShell
Stars
447
Forks
109
Avg merge
2d 19h
Merged PRs (30d)
23

Description

# Rule request

## Suggested rule change

Diagnostic logs in Event Hub should be enabled.

Enable logs and retain them for up to a year. This enables you to recreate activity trails for investigation purposes when a security incident occurs or your network is compromised.

This is actually an official Defender for Cloud recommendation.

Security pillar for this one.

## Applies to the following

The rule applies to the following:

- Resource type: **[Microsoft.EventHub/namespaces]**

## Additional context

[Diagnostic logs in Event Hub should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f83a214f7-d01a-484b-91a9-ed54470c9a6a)
[Template reference](https://learn.microsoft.com/en-us/azure/templates/microsoft.eventhub/namespaces)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.