DET-A4: Diagnostic settings removed from an attestation resource¶
diagnosticSettings were deleted on the Key Vault, confidential VM or attestation provider: the AuditEvent and Activity records these detections read stop being exported.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Azure confidential VMs |
| Group | cloud |
| Log source | Azure Activity Log · Insights |
| Related | AZURE-LOG-01 |
Fires when¶
Microsoft.Insights/diagnosticSettings deleted on an attestation resource (MAA / Key Vault)
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.