Detections
Analytics

5.1.5 Ensure that logging for Azure Key Vault is 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.

Rationale:

Monitoring how and when key vaults are accessed, and by whom, enables an audit trail of interactions with confidential information, keys, and certificates managed by Azure Keyvault. Enabling logging for Key Vault saves information in an Azure storage account which the user provides. This creates a new container named insights-logs-auditevent automatically for the specified storage account. This same storage account can be used for collecting logs for multiple key vaults.

Solution

From Azure Portal

Go to Key vaults

For each Key vault

Go to Diagnostic settings

Click on Edit Settings

Enable Archive to a storage account

Check AuditEvent

Change the retention days to be 180, 0 (for indefinite) or as appropriate

From Azure CLI

az monitor diagnostic-settings update --name 'Key vault retention policy' --resource '' --set retentionPolicy.days=90

Default Value:

By default, Diagnostic AuditEvent logging is not enabled for Key Vault instances.

See Also

https://workbench.cisecurity.org/files/4052

Item Details

References: CSCv7|6.3

Plugin: microsoft_azure

Control ID: ead6a04a77cdf8e53f604db675e1718a250ed6f9d4d7307b3e009c26405cb5fd