---
inputType: CA10Z1__CaAzureNetworkWatcherFlowLog__c
importExtracts:
- file: /types/CA10Z1__CaAzureNetworkWatcherFlowLog__c/object.extracts.yaml
testData:
- file: test-data.json
conditions:
- status: INAPPLICABLE
  currentStateMessage: This flow log targets a virtual network, subnet or interface.
  check:
    OR:
      args:
      - CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /virtualNetworks/
      - CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /networkInterfaces/
- status: UNDETERMINED
  currentStateMessage: The flow log target cannot be identified as an NSG.
  check:
    NOT:
      arg:
        CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /networkSecurityGroups/
- status: UNDETERMINED
  currentStateMessage: The disabled legacy log needs migration review before its scope can be determined.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__logStatus__c
      right:
        TEXT: Disabled
- status: UNDETERMINED
  currentStateMessage: The flow log enablement state is missing or unexpected.
  check:
    NOT:
      arg:
        IS_EQUAL:
          left:
            EXTRACT: CA10Z1__logStatus__c
          right:
            TEXT: Enabled
- status: UNDETERMINED
  currentStateMessage: The legacy flow log retention days are missing or invalid.
  check:
    OR:
      args:
      - IS_EMPTY:
          arg:
            EXTRACT: CA10Z1__retentionPolicyDays__c
      - LESS_THAN:
          left:
            EXTRACT: CA10Z1__retentionPolicyDays__c
          right:
            NUMBER: 0
- status: COMPLIANT
  currentStateMessage: The enabled legacy flow log retains records indefinitely.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyDays__c
      right:
        NUMBER: 0
- status: INCOMPLIANT
  currentStateMessage: The enabled legacy flow log retention is shorter than 90 days.
  check:
    LESS_THAN:
      left:
        EXTRACT: CA10Z1__retentionPolicyDays__c
      right:
        NUMBER: 90
  remediationMessage: Set retention to 0 or at least 90 days.
- status: COMPLIANT
  currentStateMessage: The enabled legacy flow log retains records for at least 90 days.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyStatus__c
      right:
        TEXT: Enabled
- status: INCOMPLIANT
  currentStateMessage: The legacy flow log retention policy is disabled with nonzero retention days.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyStatus__c
      right:
        TEXT: Disabled
  remediationMessage: Set retention to 0, or enable retention for at least 90 days.
otherwise:
  status: UNDETERMINED
  currentStateMessage: The retention policy enablement state is missing or unexpected.