Microsoft AzureOverview
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days.
Rationale
Flow logs enable the capture of information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.
Impact
This will keep IP traffic logs for longer than 90 days. As a level 2, determine your need to retain data and apply your selection here. As this is data stored for longer, your monthly storage costs will increase depending on your data use.
Default Value
By default, Network Security Group Flow Logs are disabled.
References
- https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview
- https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log?view=azure-cli-latest
- https://learn.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-6-configure-log-storage-retention
Remediation guidance
Remediate from Azure Portal
- Go to
Network Watcher - Select the
NSG flow logsblade in the Logs section - Select each Network Security Group from the list
- Ensure
Statusis set toOn - Set
Retention (days)to 90 or greater. - Select your storage account in the
Storage accountfield - Select
Save
Remediate from Azure CLI
Enable the NSG flow logs and set the Retention (days) to greater than or equal to 90 days.
az network watcher flow-log configure --nsg <nsgNameOrID> --enabled true --resource-group <resourceGroupName> --retention 90 --storage-account <storageAccountNameOrID>
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure NSG Flow Logs with retention shorter than 90 days
Connectors
Covered asset types
Expected check: eq []
{
flowLogs(
where: {
targetResourceID_CONTAINS: "networkSecurityGroups"
retentionPolicyDays_LT: 90
}
) {
...AssetFragment
}
}
