Microsoft.web.sites.stop.action remediation

​

Event Information

• The Microsoft.Web.sites.stop.Action event in Azure for AzureWebService indicates that a stop action has been performed on a web app or website hosted in Azure.
• This event is triggered when someone manually stops the web app or when an automated process, such as a deployment slot swap or scaling operation, stops the app temporarily.
• The event provides information about the specific web app or website that was stopped, including its name, resource group, and subscription details.

​

Examples

• Unauthorized access: If security is impacted with Microsoft.Web.sites.stop.Action in Azure for AzureWebService, it could potentially allow unauthorized access to the web application. This action could be exploited by attackers to gain control over the application or access sensitive data.
• Denial of Service (DoS) attacks: Stopping the Azure Web App using Microsoft.Web.sites.stop.Action could be used as a part of a DoS attack. By repeatedly stopping the web app, an attacker could disrupt the availability of the application, causing inconvenience to legitimate users.
• Data loss or corruption: If the Azure Web App is stopped abruptly using Microsoft.Web.sites.stop.Action, there is a risk of data loss or corruption. Any ongoing transactions or unsaved data may not be properly handled, leading to potential data integrity issues. It is important to ensure proper backup and recovery mechanisms are in place to mitigate this risk.

​

Remediation

​

Using Console

1. Enable Azure Security Center:
   • Go to the Azure portal and search for “Security Center” in the search bar.
   • Select “Security Center” from the results and click on it.
   • In the Security Center dashboard, click on “Pricing & settings” in the left menu.
   • Choose the subscription and resource group where your AzureWebService is located.
   • Click on “Apply to all resources” to enable Security Center for all resources in the selected resource group.
   • Review the pricing tier options and select the appropriate tier for your needs.
   • Click on “Save” to enable Security Center.
2. Configure Network Security Groups (NSGs):
   • Go to the Azure portal and search for “Virtual machines” in the search bar.
   • Select “Virtual machines” from the results and click on it.
   • Find the virtual machine(s) associated with your AzureWebService.
   • Click on the virtual machine to open its details page.
   • In the left menu, click on “Networking” and then “Network security group”.
   • Click on “Add inbound security rule” to create a new rule.
   • Configure the rule to allow only necessary inbound traffic to your AzureWebService, based on the previous examples.
   • Repeat the process for outbound security rules if needed.
   • Click on “Save” to apply the NSG rules.
3. Implement Azure Monitor:
   • Go to the Azure portal and search for “Monitor” in the search bar.
   • Select “Monitor” from the results and click on it.
   • In the Monitor dashboard, click on “Activity log” in the left menu.
   • Use the filter options to narrow down the activity log events related to your AzureWebService.
   • Analyze the events and identify any suspicious or unauthorized activities.
   • Take appropriate actions based on the findings, such as investigating further or blocking the source IP addresses.
   • Consider setting up alerts or notifications for specific types of events to proactively monitor your AzureWebService.

​

Using CLI

1. Enable diagnostic logs:
   • Use the az webapp log config command to enable diagnostic logs for the Azure Web Service.
   • Specify the desired log level and retention days using the --web-server-logging and --detailed-error-messages parameters respectively.
2. Enable HTTPS Only:
   • Use the az webapp update command to enable HTTPS Only for the Azure Web Service.
   • Set the --https-only parameter to true to enforce HTTPS communication.
3. Enable Web Application Firewall (WAF):
   • Use the az webapp waf config set command to enable Web Application Firewall for the Azure Web Service.
   • Specify the desired rule set type using the --firewall-mode parameter.
   • Configure additional settings like custom rules, exclusions, etc., as per your requirements.

​

Using Python

1. Monitoring and Alerting:
   • Use the Azure Monitor service to set up monitoring and alerting for your Azure Web Service.
   • Use the Azure SDK for Python to programmatically configure and manage alerts.
   • Here’s an example Python script to create an alert rule for a specific metric:
   Copy

   Ask AI

   from azure.mgmt.monitor import MonitorManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a MonitorManagementClient
   monitor_client = MonitorManagementClient(credential, subscription_id)
   
   # Define the alert rule properties
   alert_rule_properties = {
       "name": "MyAlertRule",
       "location": "eastus",
       "description": "My alert rule",
       "severity": 2,
       "enabled": True,
       "condition": {
           "odata.type": "Microsoft.Azure.Management.Monitor.Models.ThresholdRuleCondition",
           "dataSource": {
               "odata.type": "Microsoft.Azure.Management.Monitor.Models.RuleMetricDataSource",
               "resourceUri": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{webAppName}",
               "metricName": "Http5xx",
               "timeAggregation": "Average"
           },
           "operator": "GreaterThan",
           "threshold": 10,
           "windowSize": "PT5M"
       },
       "actions": []
   }
   
   # Create the alert rule
   monitor_client.alert_rules.create_or_update(
       resource_group_name,
       web_app_name,
       alert_rule_name,
       alert_rule_properties
   )
   

2. Security and Compliance:
   • Utilize Azure Security Center to enable security and compliance monitoring for your Azure Web Service.
   • Use the Azure SDK for Python to programmatically manage security policies and configurations.
   • Here’s an example Python script to enable security recommendations for your web app:
   Copy

   Ask AI

   from azure.mgmt.security import SecurityCenterManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a SecurityCenterManagementClient
   security_center_client = SecurityCenterManagementClient(credential, subscription_id)
   
   # Enable security recommendations for the web app
   security_center_client.web_application_firewall_recommendations.create(
       resource_group_name,
       web_app_name
   )
   

3. Cost Optimization:
   • Utilize Azure Cost Management and Billing to monitor and optimize costs for your Azure Web Service.
   • Use the Azure SDK for Python to programmatically retrieve cost and usage data.
   • Here’s an example Python script to retrieve cost and usage data for your web app:
   Copy

   Ask AI

   from azure.mgmt.consumption import ConsumptionManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a ConsumptionManagementClient
   consumption_client = ConsumptionManagementClient(credential, subscription_id)
   
   # Get cost and usage data for the web app
   cost_usage = consumption_client.usage_details.list(
       filter=f"properties/instanceName eq '{web_app_name}'"
   )
   
   for item in cost_usage:
       print(f"Date: {item.usage_start_date}, Cost: {item.pretax_cost}")