Event Hub should have diagnostic settings configured

Applies to

• Microsoft.EventHub/namespaces

What CGPulse checks

A resource passes this rule when diagnosticSettings.hasSettings must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure diagnostic settings to capture security events and operational data. In Azure Portal: Event Hub > Diagnostic settings > Add diagnostic setting. See: https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-diagnostic-logs

CLI

az monitor diagnostic-settings create --resource "{id}" --name "{name}-diag" --workspace var.workspace_id --logs "[{categoryGroup:allLogs,enabled:true}]" --metrics "[{category:AllMetrics,enabled:true}]"

Terraform

resource "azurerm_monitor_diagnostic_setting" "eventhub" {
  name                       = "{name}-diag"
  target_resource_id         = "{id}"
  log_analytics_workspace_id = var.workspace_id
  enabled_log {
    category_group = "allLogs"
  }
}

Compliance frameworks

• Cloud Security BaselineLT-3

Related Azure rules

• Action Group should be enabled
• Activity Log Alert should be enabled
• AKS cluster logs should be sent to Log Analytics
• AKS cluster must enable RBAC
• AKS cluster must enable RBAC
• AKS cluster should be a private cluster
• AKS cluster should disable local accounts
• AKS cluster should enable Azure RBAC for Kubernetes