Detections
Analytics

5.3.1 Ensure Application Insights are Configured

Information

Application Insights within Azure act as an Application Performance Monitoring solution providing valuable data into how well an application performs and additional information when performing incident response. The types of log data collected include application metrics, telemetry data, and application trace logging data providing organizations with detailed information about application activity and application transactions. Both data sets help organizations adopt a proactive and retroactive means to handle security and performance related metrics within their modern applications.

Rationale:

Configuring Application Insights provides additional data not found elsewhere within Azure as part of a much larger logging and monitoring program within an organization's Information Security practice. The types and contents of these logs will act as both a potential cost saving measure (application performance) and a means to potentially confirm the source of a potential incident (trace logging). Metrics and Telemetry data provide organizations with a proactive approach to cost savings by monitoring an application's performance, while the trace logging data provides necessary details in a reactive incident response scenario by helping organizations identify the potential source of an incident within their application.

Impact:

Because Application Insights relies on a Log Analytics Workspace, an organization will incur additional expenses when using this service.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Remediation Procedures
From Azure Portal

Navigate to Application Insights

Under the Basics tab within the PROJECT DETAILS section, select the Subscription

Select the Resource group

Within the INSTANCE DETAILS, enter a Name

Select a Region

Next to Resource Mode, select Workspace-based

Within the WORKSPACE DETAILS, select the Subscription for the log analytics workspace

Select the appropriate Log Analytics Workspace

Click Next:Tags >

Enter the appropriate Tags as Name, Value pairs.

Click Next:Review+Create

Click Create

From Azure CLI

az monitor app-insights component create --app <app name> --resource-group <resource group name> --location <location> --kind 'web' --retention-time <INT days to retain logs> --workspace <log analytics workspace ID> --subscription <subscription ID>

From PowerShell

New-AzApplicationInsights -Kind 'web' -ResourceGroupName <resource group name> -Name <app insights name> -location <location> -RetentionInDays <INT days to retain logs> -SubscriptionID <subscription ID> -WorkspaceResourceId <log analytics workspace ID>

See Also

https://workbench.cisecurity.org/benchmarks/10624

Item Details

References: CSCv7|6.2, CSCv7|6.3, CSCv7|18

Plugin: microsoft_azure

Control ID: 7c8284fd22e2aa92b3305c3c5991c4d6bc951d0a1ca785409a6b480f0b7c57c4