Azure Monitor Activity Log Alert

azurerm_monitor_activity_log_alert (Terraform)

The Activity Log Alert in Monitor can be configured in Terraform with the resource name azurerm_monitor_activity_log_alert. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

turbot/tdk

resource "azurerm_monitor_activity_log_alert" "setting_5_2_1" {
  name                = "policy-alert"
  resource_group_name = var.resource_group_name
  scopes              = var.scopes
  description         = "This alert will monitor all policy attachments"

cbchalmers/Azure-Monitor-Alert-Rules

resource "azurerm_monitor_activity_log_alert" "activity_log_alert_cu_security_group" {
  name                = "Activity Log Alert for Create or Update Security Group"
  resource_group_name = azurerm_resource_group.resource_group_security_services.name
  scopes              = [data.azurerm_subscription.current.id]
  description         = "Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity"
  tags                = var.resource_tags

SnidermanIndustries/checkov-fork

resource "azurerm_monitor_activity_log_alert" "ok_monitor_activity_log_alert" {
  name                = "example-activitylogalert"
  resource_group_name = azurerm_resource_group.main.name
  scopes              = [azurerm_resource_group.main.id]
  description         = "This alert will monitor a specific storage account updates."

melscoop-test/check

resource "azurerm_monitor_activity_log_alert" "ok_monitor_activity_log_alert" {
  name                = "example-activitylogalert"
  resource_group_name = azurerm_resource_group.main.name
  scopes              = [azurerm_resource_group.main.id]
  description         = "This alert will monitor a specific storage account updates."

evmcoedevsecops/kics_test_scan_files

resource "azurerm_monitor_activity_log_alert" "main1" {
  name                = "example-activitylogalert1"
  resource_group_name = azurerm_resource_group.example.name
  scopes              = [azurerm_resource_group.example.id]
  description         = "This alert will monitor a specific storage account updates."

persistentsystems/terraform-azurerm

resource "azurerm_monitor_activity_log_alert" "main" {
  name                = var.custom_rules_settings.name
  resource_group_name = var.context.resource_group_name
  scopes              = var.custom_rules_settings.scopes
  description         = var.custom_rules_settings.description

Alboroni/AlertTemplates

resource "azurerm_monitor_activity_log_alert" "TFAAlert" {
  name                = "Route Table Update"
  resource_group_name = azurerm_resource_group.TFAAlert.name
  scopes              = [azurerm_resource_group.TFAAlert.id]
  description         = "This alert will monitor is Route Table has bee created or Update."

bridgecrewio/checkov

resource "azurerm_monitor_activity_log_alert" "ok_monitor_activity_log_alert_1" {
  name                = "example-activitylogalert"
  resource_group_name = azurerm_resource_group.main.name
  scopes              = [azurerm_resource_group.main.id]
  description         = "This alert will monitor a specific storage account updates."

farrukh90/terraform-azurerm-monitor-activity-log-alert

resource "azurerm_monitor_activity_log_alert" "main" {
  name                = var.name
  resource_group_name = data.azurerm_resource_group.rg.name
  scopes              = [data.azurerm_resource_group.rg.id]
  description         = "This alert will monitor a vnet peering updates."
  criteria {

rburrs/terraform-servicehealth

resource "azurerm_monitor_activity_log_alert" "main" {
  name                = "securityalerts"
  resource_group_name = azurerm_resource_group.alertsgroup.name
  /*Scopes = var.subscriptions */
  scopes      = toset(data.azurerm_subscriptions.available.subscriptions[*].id)
  description = "This alert will monitor security related service health events."

Parameters

• description optional - string
• enabled optional - bool
• id optional computed - string
• name required - string
• resource_group_name required - string
• scopes required - set of string
• tags optional - map from string to string
• action set block
  • action_group_id required - string
  • webhook_properties optional - map from string to string
• criteria list block
  • caller optional - string
  • category required - string
  • level optional - string
  • operation_name optional - string
  • recommendation_category optional - string
  • recommendation_impact optional - string
  • recommendation_type optional - string
  • resource_group optional - string
  • resource_id optional - string
  • resource_provider optional - string
  • resource_type optional - string
  • status optional - string
  • sub_status optional - string
  • service_health list block
    • events optional - set of string
    • locations optional - set of string
    • services optional - set of string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages an Activity Log Alert within Azure Monitor.

Tips: Best Practices for The Other Azure Monitor Resources

In addition to the azurerm_monitor_log_profile, Azure Monitor has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_monitor_log_profile

Ensure to enable the activity retention log

It is better to enable the activity retention log to ensure that all the information required for an effective investigation is still available.