AlertList.md
January 28, 2021 ยท View on GitHub
IMPORTANT: DevOps Kit (AzSK) is being sunset by end of FY21. More details here
AzSK Alerts List
Mandatory Alerts
| Alert Name | Description | Operation List |
|---|---|---|
| AzSK_Subscription_Alert | Alerts for Subscription Activities | Microsoft.Authorization/elevateAccess/action Microsoft.Authorization/classicAdministrators/write Microsoft.Authorization/classicAdministrators/delete Microsoft.Authorization/locks/write Microsoft.Authorization/locks/delete Microsoft.Authorization/policyAssignments/delete Microsoft.Authorization/policyAssignments/write Microsoft.Authorization/policyDefinitions/delete Microsoft.Authorization/roleAssignments/write Microsoft.Authorization/roleAssignments/delete Microsoft.Insights/ActivityLogAlerts/Delete Microsoft.Insights/ActivityLogAlerts/Write Microsoft.Insights/ActionGroups/Write Microsoft.Insights/ActionGroups/Delete |
| AzSK_Storage_Alert | Alerts for Storage Account | Microsoft.Storage/storageAccounts/delete |
| AzSK_Database_Alert | Alerts for Database | Microsoft.Sql/servers/administrators/write Microsoft.Sql/servers/administrators/delete Microsoft.Sql/servers/firewallRules/write Microsoft.Sql/servers/firewallRules/delete Microsoft.Sql/servers/elasticPools/delete Microsoft.Sql/servers/databases/delete |
| AzSK_Networking_Alert | Alerts for Network | Microsoft.Network/dnszones/write Microsoft.Network/dnszones/delete Microsoft.Network/dnszones/MX/write Microsoft.Network/dnszones/MX/delete Microsoft.Network/dnszones/AAAA/write Microsoft.Network/dnszones/AAAA/delete Microsoft.Network/dnszones/CNAME/write Microsoft.Network/dnszones/CNAME/delete Microsoft.Network/dnszones/A/write Microsoft.Network/dnszones/A/delete Microsoft.Network/virtualNetworks/delete |
| AzSK_Security_Alert | Alerts for KeyVault | Microsoft.KeyVault/vaults/write Microsoft.KeyVault/vaults/delete Microsoft.KeyVault/vaults/secrets/write |
| AzSK_Analytics_Alert | Alerts for Analytics | Microsoft.DataLakeAnalytics/accounts/delete |
| AzSK_Compute_Alert | Alerts for Compute | Microsoft.Compute/virtualMachines/delete |
| AzSK_Web_Alert_v2 | Alerts for Web | Microsoft.Web/sites/Delete |
Optional Alerts
| Alert Name | Description | Operation List |
|---|---|---|
| AzSK_SQL_Alert | Alerts for SQL | Microsoft.Sql/servers/administrators/write Microsoft.Sql/servers/administrators/delete Microsoft.Sql/servers/firewallRules/write Microsoft.Sql/servers/firewallRules/delete Microsoft.Sql/servers/elasticPools/delete Microsoft.Sql/servers/databases/delete Microsoft.Sql/servers/databases/replicationLinks/delete Microsoft.Sql/servers/databases/replicationLinks/unlink/action Microsoft.Sql/servers/databases/dataMaskingPolicies/write Microsoft.Sql/servers/databases/dataMaskingPolicies/rules/delete Microsoft.Sql/servers/databases/dataMaskingPolicies/rules/write Microsoft.Sql/servers/databases/connectionPolicies/write Microsoft.Sql/servers/databases/transparentDataEncryption/write Microsoft.Sql/servers/databases/auditingPolicies/write Microsoft.Sql/servers/virtualNetworkRules/write Microsoft.Sql/servers/virtualNetworkRules/delete |
| AzSK_Services_Alert | Alerts for Azure Services | Microsoft.ServiceBus/namespaces/authorizationRules/write Microsoft.ServiceBus/namespaces/authorizationRules/delete Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action Microsoft.ServiceBus/namespaces/queues/Delete Microsoft.ServiceBus/namespaces/queues/authorizationRules/write Microsoft.ServiceBus/namespaces/queues/authorizationRules/delete Microsoft.ServiceBus/namespaces/queues/authorizationRules/listkeys/action Microsoft.ServiceBus/namespaces/topics/Delete Microsoft.ServiceBus/namespaces/topics/authorizationRules/write Microsoft.ServiceBus/namespaces/topics/authorizationRules/delete Microsoft.ServiceBus/namespaces/topics/authorizationRules/listkeys/action Microsoft.ServiceBus/namespaces/topics/subscriptions/Delete Microsoft.DataLakeStore/accounts/delete Microsoft.DataLakeStore/accounts/firewallRules/write Microsoft.DataLakeAnalytics/accounts/delete Microsoft.DataLakeAnalytics/accounts/storageAccounts/delete Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/delete Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/delete Microsoft.Compute/virtualMachines/extensions/write Microsoft.Compute/virtualMachines/extensions/delete Microsoft.Cache/redis/patchSchedules/delete Microsoft.DocumentDB/databaseAccounts/listKeys/action Microsoft.DocumentDB/databaseAccounts/regenerateKey/action Microsoft.Cache/redis/regenerateKey/action Microsoft.Cache/redis/firewallRules/write Microsoft.Cache/redis/firewallRules/delete Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action Microsoft.ContainerRegistry/registries/listCredentials/action Microsoft.ContainerRegistry/registries/regenerateCredential/action Microsoft.ContainerRegistry/locations/deleteVirtualNetworkOrSubnets/action Microsoft.ContainerInstance/locations/deleteVirtualNetworkOrSubnets/action Microsoft.HDInsight/clusters/updateGatewaySettings/action Microsoft.HDInsight/clusters/configurations/action Microsoft.HDInsight/clusters/applications/write Microsoft.HDInsight/clusters/applications/delete Microsoft.NotificationHubs/Namespaces/authorizationRules/write Microsoft.NotificationHubs/Namespaces/NotificationHubs/authorizationRules/write Microsoft.NotificationHubs/Namespaces/authorizationRules/listkeys/action Microsoft.NotificationHubs/Namespaces/authorizationRules/regenerateKeys/action Microsoft.NotificationHubs/Namespaces/NotificationHubs/authorizationRules/listkeys/action Microsoft.NotificationHubs/Namespaces/NotificationHubs/authorizationRules/regenerateKeys/action Microsoft.Cdn/profiles/GenerateSsoUri/action Microsoft.Cdn/profiles/endpoints/customdomains/DisableCustomHttps/action Microsoft.Automation/automationAccounts/agentRegistrationInformation/regenerateKey/action Microsoft.ApiManagement/service/users/action Microsoft.ApiManagement/service/groups/write Microsoft.ApiManagement/service/groups/users/write Microsoft.ApiManagement/service/users/write Microsoft.ApiManagement/service/users/token/action Microsoft.ApiManagement/service/users/generateSsoUrl/action Microsoft.ApiManagement/service/getssotoken/action Microsoft.ApiManagement/service/applynetworkconfigurationupdates/action Microsoft.ApiManagement/service/tenant/regeneratePrimaryKey/action Microsoft.ApiManagement/service/tenant/regenerateSecondaryKey/action Microsoft.ApiManagement/service/products/policy/write Microsoft.ApiManagement/service/products/policy/delete Microsoft.ApiManagement/service/products/policies/write Microsoft.ApiManagement/service/products/policies/delete Microsoft.ApiManagement/service/subscriptions/regeneratePrimaryKey/action Microsoft.ApiManagement/service/subscriptions/regenerateSecondaryKey/action Microsoft.ApiManagement/service/apis/operations/policy/write Microsoft.ApiManagement/service/apis/operations/policy/delete Microsoft.ApiManagement/service/apis/operations/policies/write Microsoft.ApiManagement/service/apis/operations/policies/delete |
| AzSK_Network_Alert | Alerts for Network | Microsoft.Network/dnszones/write Microsoft.Network/dnszones/delete Microsoft.Network/dnszones/MX/write Microsoft.Network/dnszones/MX/delete Microsoft.Network/dnszones/AAAA/write Microsoft.Network/dnszones/AAAA/delete Microsoft.Network/dnszones/CNAME/write Microsoft.Network/dnszones/CNAME/delete Microsoft.Network/dnszones/A/write Microsoft.Network/dnszones/A/delete Microsoft.Network/networkInterfaces/write Microsoft.Network/networkInterfaces/join/action Microsoft.Network/networkInterfaces/delete Microsoft.Network/publicIPAddresses/delete Microsoft.Network/virtualNetworks/write Microsoft.Network/virtualNetworks/delete Microsoft.Network/virtualNetworks/peer/action Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete Microsoft.Network/virtualNetworks/subnets/write Microsoft.Network/virtualNetworks/subnets/delete Microsoft.Network/virtualNetworks/subnets/join/action Microsoft.Network/networkSecurityGroups/write Microsoft.Network/networkSecurityGroups/delete Microsoft.Network/networkSecurityGroups/join/action Microsoft.Network/networkSecurityGroups/securityRules/write Microsoft.Network/networkSecurityGroups/securityRules/delete Microsoft.Network/routeTables/write Microsoft.Network/routeTables/delete Microsoft.Network/routeTables/join/action Microsoft.Network/routeTables/routes/write Microsoft.Network/routeTables/routes/delete Microsoft.Network/loadBalancers/inboundNatRules/write Microsoft.Network/trafficManagerProfiles/azureEndpoints/write Microsoft.Network/trafficManagerProfiles/externalEndpoints/write Microsoft.Network/trafficManagerProfiles/nestedEndpoints/write |
| AzSK_Web_Alert | Alerts for Web | Microsoft.Web/sites/Delete Microsoft.Web/sites/slotsswap/Action Microsoft.Web/sites/applySlotConfig/Action Microsoft.Web/sites/slots/config/Write Microsoft.Web/sites/slots/config/list/Action Microsoft.Web/sites/config/Write Microsoft.Web/sites/config/list/Action Microsoft.Web/sites/functions/listSecrets/Action Microsoft.Web/certificates/Write Microsoft.Web/certificates/Delete Microsoft.web/publishingusers/write Microsoft.Web/sites/publishxml/Action Microsoft.web/sites/virtualnetworkconnections/write Microsoft.web/sites/virtualnetworkconnections/delete |
| AzSK_KeyVault_Alert | Alerts for KeyVault | Microsoft.KeyVault/vaults/write Microsoft.KeyVault/vaults/delete Microsoft.KeyVault/vaults/deploy/action Microsoft.KeyVault/vaults/secrets/read Microsoft.KeyVault/vaults/secrets/write |