Azure / Azure/PSRule.Rules.Azure
Diagnostic logs in Event Hub should be enabled
- Dominant language
- PowerShell
- Stars
- 447
- Forks
- 109
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 23
Description
# Rule request
## Suggested rule change
Diagnostic logs in Event Hub should be enabled.
Enable logs and retain them for up to a year. This enables you to recreate activity trails for investigation purposes when a security incident occurs or your network is compromised.
This is actually an official Defender for Cloud recommendation.
Security pillar for this one.
## Applies to the following
The rule applies to the following:
- Resource type: **[Microsoft.EventHub/namespaces]**
## Additional context
[Diagnostic logs in Event Hub should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f83a214f7-d01a-484b-91a9-ed54470c9a6a)
[Template reference](https://learn.microsoft.com/en-us/azure/templates/microsoft.eventhub/namespaces)
Contributor guide
Assessment
This issue has not been assessed yet.