[RULE] Collect audit logs for Azure Container Reigstry #3445
Description
Existing rule
No response
Suggested rule
Enable Azure resource logs for Container Registry for ContainerRegistryLoginEvents and ContainerRegistryRepositoryEvents.
Pillar
Security
Additional context
Similar to Azure.KeyVault.Logs
- https://learn.microsoft.com/en-us/azure/container-registry/monitor-container-registry-reference#resource-logs
- https://learn.microsoft.com/en-gb/security/benchmark/azure/baselines/container-registry-security-baseline?toc=%2Fazure%2Fcontainer-registry%2FTOC.json#lt-4-enable-logging-for-security-investigation