AZDO.1010 - Audit streaming.
Overview
Audit logs should be retained according to your organization's needs and protected from purging.
Rationale: Send auditing data to other Security Incident and Event Management (SIEM) tools and open new possibilities, such as the ability to trigger alerts for specific events, create views on auditing data, and perform anomaly detection. Setting up a stream also allows you to store more than 90-days of auditing data, which is the maximum amount of data that Azure DevOps keeps for your organizations.
Remediation action
Create an audit stream, which sends data to other locations for further processing.
- Sign in to your organization.
- Choose Organization settings.
- Select Auditing.
If you don't see Auditing in Organization Settings, then auditing is not currently enabled for your organization. Someone in the organization owner or Project Collection Administrators (PCAs) group must enable Auditing in Organization Policies. You will then be able to see events on the Auditing page if you have the appropriate permissions.
- Go to the Streams tab, and then select New stream.
- Select the stream target that you want to configure, and then select from the following instructions to set up your stream target type.
- Splunk
- Event Grid
- Azure Monitor Log
Results: Audit streams represent a pipeline that flows audit events from your Azure DevOps organization to a stream target. At least every half hour, new audit events are bundled and streamed to your targets.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1010 |
| Severity | High |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoAuditStream |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops |
| Tags | AZDO, AZDO.1010 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1010.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1010.md