feat(azure): 10 new checks related with alerts in monitoring (#3516)

prowler/providers/azure/services/monitor/lib/monitor_alerts.py

@@ -0,0 +1,23 @@
+"""
+This module contains functions related to monitoring alerts in Azure.
+"""
+
+
+def check_alert_rule(alert_rule, expected_equal) -> bool:
+    """
+    Checks if an alert rule meets the specified condition.
+
+    Args:
+        alert_rule: An object representing the alert rule to be checked.
+        expected_equal: The expected value for the "operationName" field.
+
+    Returns:
+        A boolean value indicating whether the alert rule meets the condition.
+    """
+
+    if alert_rule.enabled:
+        for element in alert_rule.condition.all_of:
+            if element.field == "operationName" and element.equals == expected_equal:
+                return True
+
+    return False

prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_create_policy_assignment",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Create Policy Assignment",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Create Policy Assignment event.",
+  "Risk": "Monitoring for create policy assignment events gives insight into changes done in 'Azure policy - assignments' and can reduce the time it takes to detect unsolicited changes.",
+  "RelatedUrl": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write and level=<verbose | information | warning | error | critical> --scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription ID> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-alert-for-create-policy-assignment-events.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Policy assignment (policyAssignments). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create policy assignment (Microsoft.Authorization/policyAssignments). 12. Select the Actions tab. 13. To use an existing action group, click elect action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py

@@ -0,0 +1,33 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_create_policy_assignment(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Authorization/policyAssignments/write"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for creating Policy Assignments in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_create_update_policy_assignment",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Network Security Group",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.",
+  "Risk": "Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' --subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-update-network-security-group-rule-alert-in-use.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Network security groups. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Network Security Group (Microsoft.Network/networkSecurityGroups). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_create_update_nsg(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Network/networkSecurityGroups/write"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for creating/updating Network Security Groups in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_create_update_public_ip_address_rule",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Public IP Address rule",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.",
+  "Risk": "Monitoring for Create or Update Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-public-ip-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Public IP addresses. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Public Ip Address (Microsoft.Network/publicIPAddresses). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py

@@ -0,0 +1,33 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_create_update_public_ip_address_rule(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Network/publicIPAddresses/write"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for creating/updating Public IP address rule in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_create_update_security_solution",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Security Solution",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Create or Update Security Solution event.",
+  "Risk": "Monitoring for Create or Update Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/write and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-security-solution-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Security Solutions (securitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_create_update_security_solution(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Security/securitySolutions/write"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for creating/updating Security Solution in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_create_update_sqlserver_fr",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.",
+  "Risk": "Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-or-delete-sql-server-firewall-rule-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Server Firewall Rule (servers/firewallRules). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create/Update server firewall rule (Microsoft.Sql/servers/firewallRules). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_create_update_sqlserver_fr(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Sql/servers/firewallRules/write"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_delete_nsg",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Delete Network Security Group",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Delete Network Security Group event.",
+  "Risk": "Monitoring for 'Delete Network Security Group' events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-network-security-group-rule-alert-in-use.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Network security groups. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Network Security Group (Microsoft.Network/networkSecurityGroups). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py

@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_delete_nsg(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Network/networkSecurityGroups/delete"
+                ) or check_alert_rule(
+                    alert_rule, "Microsoft.ClassicNetwork/networkSecurityGroups/delete"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for deleting Network Security Groups in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_delete_policy_assignment",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Delete Policy Assignment",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Delete Policy Assignment event.",
+  "Risk": "Monitoring for delete policy assignment events gives insight into changes done in 'azure policy - assignments' and can reduce the time it takes to detect unsolicited changes.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/delete and level=<verbose | information | warning | error | critical> --scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-policy-assignment-alert-in-use.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Policy assignment (policyAssignments). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete policy assignment (Microsoft.Authorization/policyAssignments). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_delete_policy_assignment(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Authorization/policyAssignments/delete"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for deleting policy assignment in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_delete_public_ip_address_rule",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Delete Public IP Address rule",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Delete Public IP Address rule.",
+  "Risk": "Monitoring for Delete Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-public-ip-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Public IP addresses. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Public Ip Address (Microsoft.Network/publicIPAddresses). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_delete_public_ip_address_rule(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Network/publicIPAddresses/delete"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for deleting public IP address rule in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_delete_security_solution",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Delete Security Solution",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the Delete Security Solution event.",
+  "Risk": "Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/delete and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-security-solution-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Security Solutions (securitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.curitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_delete_security_solution(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Security/securitySolutions/delete"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for deleting Security Solution in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "monitor_alert_delete_sqlserver_fr",
+  "CheckTitle": "Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule",
+  "CheckType": [],
+  "ServiceName": "monitor",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Monitor",
+  "Description": "Create an activity log alert for the 'Delete SQL Server Firewall Rule.'",
+  "Risk": "Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.",
+  "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log",
+  "Remediation": {
+    "Code": {
+      "CLI": "az monitor activity-log alert create --resource-group '<resource group name>' --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level=<verbose | information | warning | error | critical>--scope '/subscriptions/<subscription ID>' --name '<activity log rule name>' -- subscription <subscription id> --action-group <action group ID> --location global",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-or-delete-sql-server-firewall-rule-alert.html#trendmicro",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Server Firewall Rule (servers/firewallRules). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete server firewall rule (Microsoft.Sql/servers/firewallRules). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.",
+      "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "By default, no monitoring alerts are created."
+}

prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
+from prowler.providers.azure.services.monitor.monitor_client import monitor_client
+
+
+class monitor_alert_delete_sqlserver_fr(Check):
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for (
+            subscription_name,
+            activity_log_alerts,
+        ) in monitor_client.alert_rules.items():
+            report = Check_Report_Azure(self.metadata())
+            report.status = "FAIL"
+            report.subscription = subscription_name
+            report.resource_name = "Monitor"
+            report.resource_id = "Monitor"
+            report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}."
+            for alert_rule in activity_log_alerts:
+                if check_alert_rule(
+                    alert_rule, "Microsoft.Sql/servers/firewallRules/delete"
+                ):
+                    report.status = "PASS"
+                    report.resource_name = alert_rule.name
+                    report.resource_id = alert_rule.id
+                    report.subscription = subscription_name
+                    report.status_extended = f"There is an alert configured for deleting SQL Server firewall rule in subscription {subscription_name}."
+                    break
+
+            findings.append(report)
+        return findings

prowler/providers/azure/services/monitor/monitor_service.py

@@ -1,7 +1,7 @@
 from dataclasses import dataclass
 
 from azure.mgmt.monitor import MonitorManagementClient
-from azure.mgmt.monitor.models import LogSettings
+from azure.mgmt.monitor.models import AlertRuleAllOfCondition, LogSettings
 
 from prowler.lib.logger import logger
 from prowler.providers.azure.lib.service.service import AzureService
@@ -13,6 +13,7 @@ class Monitor(AzureService):
         super().__init__(MonitorManagementClient, audit_info)
 
         self.diagnostics_settings = self.__get_diagnostics_settings__()
+        self.alert_rules = self.get_alert_rules()
 
     def __get_diagnostics_settings__(self):
         logger.info("Monitor - Getting diagnostics settings...")
@@ -41,6 +42,29 @@ class Monitor(AzureService):
                 )
         return diagnostics_settings
 
+    def get_alert_rules(self):
+        logger.info("Monitor - Getting alert rules...")
+        alert_rules = {}
+        for subscription, client in self.clients.items():
+            try:
+                alert_rules.update({subscription: []})
+                rules = client.activity_log_alerts.list_by_subscription_id()
+                for rule in rules:
+                    alert_rules[subscription].append(
+                        AlertRule(
+                            id=rule.id,
+                            name=rule.name,
+                            condition=rule.condition,
+                            enabled=rule.enabled,
+                            description=rule.description,
+                        )
+                    )
+            except Exception as error:
+                logger.error(
+                    f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        return alert_rules
+
 
 @dataclass
 class DiagnosticSetting:
@@ -48,3 +72,12 @@ class DiagnosticSetting:
     storage_account_id: str
     storage_account_name: str
     logs: LogSettings
+
+
+@dataclass
+class AlertRule:
+    id: str
+    name: str
+    condition: AlertRuleAllOfCondition
+    enabled: bool
+    description: str

tests/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment_test.py

@@ -0,0 +1,106 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_policy_assignment:
+    def test_monitor_alert_create_policy_assignment_no_subscriptions(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {}
+
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import (
+                monitor_alert_create_policy_assignment,
+            )
+
+            check = monitor_alert_create_policy_assignment()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import (
+                monitor_alert_create_policy_assignment,
+            )
+
+            check = monitor_alert_create_policy_assignment()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Authorization/policyAssignments/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Authorization/policyAssignments/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import (
+                monitor_alert_create_policy_assignment,
+            )
+
+            check = monitor_alert_create_policy_assignment()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_nsg:
+    def test_monitor_alert_create_update_nsg_no_subscriptions(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import (
+                monitor_alert_create_update_nsg,
+            )
+
+            check = monitor_alert_create_update_nsg()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import (
+                monitor_alert_create_update_nsg,
+            )
+
+            check = monitor_alert_create_update_nsg()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/networkSecurityGroups/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/networkSecurityGroups/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import (
+                monitor_alert_create_update_nsg,
+            )
+
+            check = monitor_alert_create_update_nsg()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_security_solution:
+    def test_monitor_alert_create_update_public_ip_address_rule_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import (
+                monitor_alert_create_update_public_ip_address_rule,
+            )
+
+            check = monitor_alert_create_update_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import (
+                monitor_alert_create_update_public_ip_address_rule,
+            )
+
+            check = monitor_alert_create_update_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/publicIPAddresses/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/publicIPAddresses/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import (
+                monitor_alert_create_update_public_ip_address_rule,
+            )
+
+            check = monitor_alert_create_update_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_security_solution:
+    def test_monitor_alert_create_update_security_solution_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import (
+                monitor_alert_create_update_security_solution,
+            )
+
+            check = monitor_alert_create_update_security_solution()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import (
+                monitor_alert_create_update_security_solution,
+            )
+
+            check = monitor_alert_create_update_security_solution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Security/securitySolutions/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Security/securitySolutions/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import (
+                monitor_alert_create_update_security_solution,
+            )
+
+            check = monitor_alert_create_update_security_solution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_sqlserver_fr:
+    def test_monitor_alert_create_update_sqlserver_fr_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import (
+                monitor_alert_create_update_sqlserver_fr,
+            )
+
+            check = monitor_alert_create_update_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import (
+                monitor_alert_create_update_sqlserver_fr,
+            )
+
+            check = monitor_alert_create_update_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Sql/servers/firewallRules/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Sql/servers/firewallRules/write",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import (
+                monitor_alert_create_update_sqlserver_fr,
+            )
+
+            check = monitor_alert_create_update_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_delete_nsg:
+    def test_monitor_alert_delete_nsg_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import (
+                monitor_alert_delete_nsg,
+            )
+
+            check = monitor_alert_delete_nsg()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import (
+                monitor_alert_delete_nsg,
+            )
+
+            check = monitor_alert_delete_nsg()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/networkSecurityGroups/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/networkSecurityGroups/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import (
+                monitor_alert_delete_nsg,
+            )
+
+            check = monitor_alert_delete_nsg()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment_test.py

@@ -0,0 +1,106 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_delete_policy_assignment:
+    def test_monitor_alert_delete_policy_assignment_no_subscriptions(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {}
+
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import (
+                monitor_alert_delete_policy_assignment,
+            )
+
+            check = monitor_alert_delete_policy_assignment()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import (
+                monitor_alert_delete_policy_assignment,
+            )
+
+            check = monitor_alert_delete_policy_assignment()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Authorization/policyAssignments/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Authorization/policyAssignments/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import (
+                monitor_alert_delete_policy_assignment,
+            )
+
+            check = monitor_alert_delete_policy_assignment()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_security_solution:
+    def test_monitor_alert_delete_public_ip_address_rule_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import (
+                monitor_alert_delete_public_ip_address_rule,
+            )
+
+            check = monitor_alert_delete_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import (
+                monitor_alert_delete_public_ip_address_rule,
+            )
+
+            check = monitor_alert_delete_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/publicIPAddresses/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Network/publicIPAddresses/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import (
+                monitor_alert_delete_public_ip_address_rule,
+            )
+
+            check = monitor_alert_delete_public_ip_address_rule()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_create_update_security_solution:
+    def test_monitor_alert_delete_security_solution_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import (
+                monitor_alert_delete_security_solution,
+            )
+
+            check = monitor_alert_delete_security_solution()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import (
+                monitor_alert_delete_security_solution,
+            )
+
+            check = monitor_alert_delete_security_solution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Security/securitySolutions/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Security/securitySolutions/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import (
+                monitor_alert_delete_security_solution,
+            )
+
+            check = monitor_alert_delete_security_solution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr_test.py

@@ -0,0 +1,105 @@
+from unittest import mock
+
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
+)
+from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION
+
+
+class Test_monitor_alert_delete_sqlserver_fr:
+    def test_monitor_alert_delete_sqlserver_fr_no_subscriptions(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import (
+                monitor_alert_delete_sqlserver_fr,
+            )
+
+            check = monitor_alert_delete_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_alert_rules(self):
+        monitor_client = mock.MagicMock()
+        monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []}
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import (
+                monitor_alert_delete_sqlserver_fr,
+            )
+
+            check = monitor_alert_delete_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "Monitor"
+            assert result[0].resource_id == "Monitor"
+            assert (
+                result[0].status_extended
+                == f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}."
+            )
+
+    def test_alert_rules_configured(self):
+        monitor_client = mock.MagicMock
+        monitor_client.alert_rules = {
+            AZURE_SUBSCRIPTION: [
+                AlertRule(
+                    id="id",
+                    name="name",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Sql/servers/firewallRules/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=False,
+                    description="description",
+                ),
+                AlertRule(
+                    id="id2",
+                    name="name2",
+                    condition=AlertRuleAllOfCondition(
+                        all_of=[
+                            AlertRuleAnyOfOrLeafCondition(),
+                            AlertRuleAnyOfOrLeafCondition(
+                                equals="Microsoft.Sql/servers/firewallRules/delete",
+                                field="operationName",
+                            ),
+                        ]
+                    ),
+                    enabled=True,
+                    description="description2",
+                ),
+            ]
+        }
+        with mock.patch(
+            "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client",
+            new=monitor_client,
+        ):
+            from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import (
+                monitor_alert_delete_sqlserver_fr,
+            )
+
+            check = monitor_alert_delete_sqlserver_fr()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].subscription == AZURE_SUBSCRIPTION
+            assert result[0].resource_name == "name2"
+            assert result[0].resource_id == "id2"
+            assert (
+                result[0].status_extended
+                == f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}."
+            )

tests/providers/azure/services/monitor/monitor_service_test.py

@@ -1,7 +1,12 @@
 from unittest import mock
 from unittest.mock import patch
 
+from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
+
+from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
 from prowler.providers.azure.services.monitor.monitor_service import (
+    AlertRule,
+    AlertRuleAllOfCondition,
     DiagnosticSetting,
     Monitor,
 )
@@ -101,3 +106,66 @@ class Test_Monitor_Service:
             monitor.diagnostics_settings[AZURE_SUBSCRIPTION][0].storage_account_id
             == "/subscriptions/1234a5-123a-123a-123a-1234567890ab/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/storageaccountname"
         )
+
+    def test__monitor_alerts_false__(self):
+        alert_rule = AlertRule(
+            id="id",
+            name="name",
+            condition=AlertRuleAllOfCondition(
+                all_of=[
+                    AlertRuleAnyOfOrLeafCondition(),
+                    AlertRuleAnyOfOrLeafCondition(
+                        equals="Microsoft.Authorization/policyAssignments/write",
+                        field="operationName",
+                    ),
+                ]
+            ),
+            enabled=False,
+            description="description",
+        )
+
+        assert not check_alert_rule(
+            alert_rule, "Microsoft.Authorization/policyAssignments/write"
+        )
+
+    def test__monitor_alerts_true__(self):
+        alert_rule = AlertRule(
+            id="id",
+            name="name",
+            condition=AlertRuleAllOfCondition(
+                all_of=[
+                    AlertRuleAnyOfOrLeafCondition(),
+                    AlertRuleAnyOfOrLeafCondition(
+                        equals="Microsoft.Authorization/policyAssignments/write",
+                        field="operationName",
+                    ),
+                ]
+            ),
+            enabled=True,
+            description="description",
+        )
+
+        assert check_alert_rule(
+            alert_rule, "Microsoft.Authorization/policyAssignments/write"
+        )
+
+    def test__monitor_alerts_false_equal__(self):
+        alert_rule = AlertRule(
+            id="id",
+            name="name",
+            condition=AlertRuleAllOfCondition(
+                all_of=[
+                    AlertRuleAnyOfOrLeafCondition(),
+                    AlertRuleAnyOfOrLeafCondition(
+                        equals="Microsoft.Authorization/policyAssingments/write",
+                        field="operationName",
+                    ),
+                ]
+            ),
+            enabled=True,
+            description="description",
+        )
+
+        assert not check_alert_rule(
+            alert_rule, "Microsoft.Authorization/policyAssignments/write"
+        )