↳ Source GitHubRègle analytiqueMedium
M2131_LogRetentionLessThan1Year
Description
'This alert is designed to monitor log retention within the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a log analytics workspace in active storage is configured for less than 1 year.'
- Type de règle
- Scheduled
- Version
- 1.0.0
- Statut déclaré
- Available
- Fréquence
- 1d
- Période analysée
- 14d
- Déclenchement
- gt 0
Couverture MITRE déclarée
Requête KQL
Requête originale, sans modification.
SecurityRecommendation
| summarize arg_max(TimeGenerated, *) by RecommendationDisplayName, AssessedResourceId
| where RecommendationDisplayName == "Activity log should be retained for at least one year"
| summarize Failed = countif(RecommendationState == "Unhealthy"), Passed = countif(RecommendationState == "Healthy"), Total = countif(RecommendationState == "Healthy" or RecommendationState == "Unhealthy") by RecommendationDisplayName, AssessedResourceId
| extend PassedControls = (Passed/todouble(Total))*100
| extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22')
| project RecommendationDisplayName, AssessedResourceId, Total, PassedControls, Passed, Failed, RemediationLink, LastObserved=now()
| where Failed > 0
| sort by Failed desc
| extend URLCustomEntity = RemediationLink, ResourceId = AssessedResourceId
Entités déclarées
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
9800e51↗- Identifiant source
8178a514-1270-4e31-a1d9-aaafeb40122f
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC