App Service logs should be sent to Log Analytics

Applies to

• Microsoft.Web/sites

What CGPulse checks

A resource passes this rule when diagnosticSettings.hasLogAnalytics must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure diagnostic logs to Log Analytics for centralized security monitoring. In Azure Portal: App Service > Diagnostic settings > Add diagnostic setting > select Log Analytics workspace. See: https://learn.microsoft.com/en-us/azure/app-service/troubleshoot-diagnostic-logs

CLI

az monitor diagnostic-settings create --resource "{id}" --name "{name}-diag" --workspace var.workspace_id --logs "[{categoryGroup:allLogs,enabled:true}]" --metrics "[{category:AllMetrics,enabled:true}]"

Terraform

resource "azurerm_monitor_diagnostic_setting" "webapp" {
  name                       = "{name}-diag"
  target_resource_id         = "{id}"
  log_analytics_workspace_id = var.workspace_id
  enabled_log {
    category_group = "allLogs"
  }
}

Compliance frameworks

• Cloud Security BaselineLT-5

Related Azure rules

• Action Group should be enabled
• Activity Log Alert should be enabled
• AKS cluster logs should be sent to Log Analytics
• AKS cluster must enable RBAC
• AKS cluster must enable RBAC
• AKS cluster should be a private cluster
• AKS cluster should disable local accounts
• AKS cluster should enable Azure RBAC for Kubernetes