About

This article explains how to fix a failing Azure check about network security group deletions. ControlMap checks your Azure connection against its Azure Baseline Controls. One of these checks looks for an activity log alert that fires when a network security group is deleted.

An alert on this event tells admins and other users when the network changes, so any suspicious activity is dealt with at the right time.

Find the failing check in ControlMap

1. Go to Monitor › Compliance Checks.
2. Find the Azure check with the status Failing. To narrow the list, use the filters at the top of the table.
3. Open the Compliance check actions menu on the check's row and select View Evidence, then open the Scan results tab to see the result.

Create the alert in Azure

Do these steps in the Azure portal.

1. Go to Monitor › Alerts and create a new alert rule.
2. Under Scope, select the resource, then select your subscription.
3. Under Condition, select Select Condition.
4. In the search box, enter Delete Network Security Group and select Delete Network Security Group (Microsoft.Network/networkSecurityGroups).
5. Under Action group, select Select action group.
6. Select the action group to attach to the alert rule, or create one if you need to, then select Select.
7. Enter an alert rule name and a description.
8. Select a resource group.
9. Create the alert rule.

Run the scan again

1. Go to Monitor › Integrations and open your Azure connection from its card.
2. Select Run Once. A message says the scan is scheduled to start in the next few minutes.
3. When the scan finishes, go back to Monitor › Compliance Checks to see the updated status.

Connections also scan on their weekly schedule, so the status updates on its own if you don't run it manually.

More information

For more on alerts in Azure, see Microsoft's activity log alerts guide and metric alerts guide.