azure-monitor-audit

1# Azure Monitor Audit
2 
3Audit Azure activity with Monitor, Activity Logs, and Log Analytics for compliance, security, and operational visibility.
4 
5## When to Use
6 
7- Enabling centralized audit logging across Azure subscriptions
8- Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or ISO 27001
9- Investigating security incidents or unauthorized activity in Azure
10- Setting up alerting on administrative and security events
11- Building compliance dashboards and automated evidence collection
12 
13## Create Log Analytics Workspace
14 
15```bash
16# Create resource group for audit resources
17az group create \
18  --name rg-audit \
19  --location eastus
20 
21# Create Log Analytics workspace
22az monitor log-analytics workspace create \
23  --resource-group rg-audit \
24  --workspace-name audit-workspace \
25  --location eastus \
26  --retention-time 365 \
27  --sku PerGB2018
28 
29# Get workspace ID for later use
30WORKSPACE_ID=$(az monitor log-analytics workspace show \
31  --resource-group rg-audit \
32  --workspace-name audit-workspace \
33  --query id -o tsv)
34 
35# Enable audit solutions
36az monitor log-analytics solution create \
37  --resource-group rg-audit \
38  --solution-type SecurityCenterFree \
39  --workspace audit-workspace
40```
41 
42## Configure Diagnostic Settings for Subscription Activity Log
43 
44```bash
45# Export subscription activity log to Log Analytics
46az monitor diagnostic-settings subscription create \
47  --name activity-log-to-workspace \
48  --location global \
49  --workspace "$WORKSPACE_ID" \
50  --logs '[
51…