--- policy: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention logic: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml executionTime: 2026-11-14T12:03:55.443712707Z generationMs: 60 executionMs: 705 rows: - id: legacy-89 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 799 actual: 799 conditionText: expected: extract('CA10Z1__retentionPolicyDays__c') < number(90.0) actual: extract('CA10Z1__retentionPolicyDays__c') < number(90.0) runtimeError: {} - id: legacy-90 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 899 actual: 899 conditionText: expected: extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled' actual: extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled' runtimeError: {} - id: legacy-91 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 899 actual: 899 conditionText: expected: extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled' actual: extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled' runtimeError: {} - id: legacy-zero match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 699 actual: 699 conditionText: expected: extract('CA10Z1__retentionPolicyDays__c') == number(0.0) actual: extract('CA10Z1__retentionPolicyDays__c') == number(0.0) runtimeError: {} - id: legacy-disabled-migration-unknown match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 399 actual: 399 conditionText: expected: extract('CA10Z1__logStatus__c') == 'Disabled' actual: extract('CA10Z1__logStatus__c') == 'Disabled' runtimeError: {} - id: legacy-disabled-retention match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 999 actual: 999 conditionText: expected: extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled' actual: extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled' runtimeError: {} - id: legacy-missing-days match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 599 actual: 599 conditionText: expected: extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0) actual: extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0) runtimeError: {} - id: legacy-negative-days match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 599 actual: 599 conditionText: expected: extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0) actual: extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0) runtimeError: {} - id: legacy-unknown-state match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 499 actual: 499 conditionText: expected: not(extract('CA10Z1__logStatus__c') == 'Enabled') actual: not(extract('CA10Z1__logStatus__c') == 'Enabled') runtimeError: {} - id: legacy-missing-state match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 499 actual: 499 conditionText: expected: not(extract('CA10Z1__logStatus__c') == 'Enabled') actual: not(extract('CA10Z1__logStatus__c') == 'Enabled') runtimeError: {} - id: legacy-unknown-retention match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 1000 actual: 1000 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: legacy-missing-retention match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 1000 actual: 1000 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: legacy-vnet match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') actual: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') runtimeError: {} - id: legacy-subnet match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') actual: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') runtimeError: {} - id: legacy-nic match: true status: expected: INAPPLICABLE actual: INAPPLICABLE conditionIndex: expected: 199 actual: 199 conditionText: expected: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') actual: extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/') runtimeError: {} - id: legacy-unknown-target match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 299 actual: 299 conditionText: expected: not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/')) actual: not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/')) runtimeError: {} - id: legacy-missing-target match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 299 actual: 299 conditionText: expected: not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/')) actual: not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/')) runtimeError: {} - id: legacy-disappeared match: true status: expected: DISAPPEARED actual: DISAPPEARED conditionIndex: expected: 99 actual: 99 conditionText: expected: isDisappeared(CA10Z1__disappearanceTime__c) actual: isDisappeared(CA10Z1__disappearanceTime__c) runtimeError: {} usedFiles: - path: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/policy.yaml md5Hash: 4A75A7F113B1A1EF20884B965CAF7136 content: | --- names: full: Azure Legacy NSG Flow Log retention is insufficient contextual: Legacy NSG Flow Log retention is insufficient description: Assess retention on collected NSG flow logs still in use; disabled logs require manual migration review because collection does not identify migration leftovers. type: COMPLIANCE_POLICY categories: - SECURITY frameworkMappings: - /frameworks/cis-azure-v7.0.0/07/12 - /frameworks/cloudaware/logging-and-monitoring/logging-and-monitoring-configuration - path: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml md5Hash: DB84F31F5A535E319C36A2070A7D8BA5 content: | --- inputType: CA10Z1__CaAzureNetworkWatcherFlowLog__c importExtracts: - file: /types/CA10Z1__CaAzureNetworkWatcherFlowLog__c/object.extracts.yaml testData: - file: test-data.json conditions: - status: INAPPLICABLE currentStateMessage: This flow log targets a virtual network, subnet or interface. check: OR: args: - CONTAINS: arg: EXTRACT: CA10Z1__targetResourceId__c search: TEXT: /virtualNetworks/ - CONTAINS: arg: EXTRACT: CA10Z1__targetResourceId__c search: TEXT: /networkInterfaces/ - status: UNDETERMINED currentStateMessage: The flow log target cannot be identified as an NSG. check: NOT: arg: CONTAINS: arg: EXTRACT: CA10Z1__targetResourceId__c search: TEXT: /networkSecurityGroups/ - status: UNDETERMINED currentStateMessage: The disabled legacy log needs migration review before its scope can be determined. check: IS_EQUAL: left: EXTRACT: CA10Z1__logStatus__c right: TEXT: Disabled - status: UNDETERMINED currentStateMessage: The flow log enablement state is missing or unexpected. check: NOT: arg: IS_EQUAL: left: EXTRACT: CA10Z1__logStatus__c right: TEXT: Enabled - status: UNDETERMINED currentStateMessage: The legacy flow log retention days are missing or invalid. check: OR: args: - IS_EMPTY: arg: EXTRACT: CA10Z1__retentionPolicyDays__c - LESS_THAN: left: EXTRACT: CA10Z1__retentionPolicyDays__c right: NUMBER: 0 - status: COMPLIANT currentStateMessage: The enabled legacy flow log retains records indefinitely. check: IS_EQUAL: left: EXTRACT: CA10Z1__retentionPolicyDays__c right: NUMBER: 0 - status: INCOMPLIANT currentStateMessage: The enabled legacy flow log retention is shorter than 90 days. check: LESS_THAN: left: EXTRACT: CA10Z1__retentionPolicyDays__c right: NUMBER: 90 remediationMessage: Set retention to 0 or at least 90 days. - status: COMPLIANT currentStateMessage: The enabled legacy flow log retains records for at least 90 days. check: IS_EQUAL: left: EXTRACT: CA10Z1__retentionPolicyStatus__c right: TEXT: Enabled - status: INCOMPLIANT currentStateMessage: The legacy flow log retention policy is disabled with nonzero retention days. check: IS_EQUAL: left: EXTRACT: CA10Z1__retentionPolicyStatus__c right: TEXT: Disabled remediationMessage: Set retention to 0, or enable retention for at least 90 days. otherwise: status: UNDETERMINED currentStateMessage: The retention policy enablement state is missing or unexpected. - path: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/test-data.json md5Hash: 2E36513CB47492AA7D1EA15F62CC85F8 content: | [ { "Id": "legacy-89", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 89, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "INCOMPLIANT", "runtimeError": null, "conditionIndex": 799, "conditionText": "extract('CA10Z1__retentionPolicyDays__c') < number(90.0)" } }, { "Id": "legacy-90", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 899, "conditionText": "extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'" } }, { "Id": "legacy-91", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 91, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 899, "conditionText": "extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'" } }, { "Id": "legacy-zero", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 0, "CA10Z1__retentionPolicyStatus__c": "Disabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "COMPLIANT", "runtimeError": null, "conditionIndex": 699, "conditionText": "extract('CA10Z1__retentionPolicyDays__c') == number(0.0)" } }, { "Id": "legacy-disabled-migration-unknown", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Disabled", "CA10Z1__retentionPolicyDays__c": 7, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 399, "conditionText": "extract('CA10Z1__logStatus__c') == 'Disabled'" } }, { "Id": "legacy-disabled-retention", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Disabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "INCOMPLIANT", "runtimeError": null, "conditionIndex": 999, "conditionText": "extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled'" } }, { "Id": "legacy-missing-days", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": null, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 599, "conditionText": "extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)" } }, { "Id": "legacy-negative-days", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": -1, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 599, "conditionText": "extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)" } }, { "Id": "legacy-unknown-state", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Other", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 499, "conditionText": "not(extract('CA10Z1__logStatus__c') == 'Enabled')" } }, { "Id": "legacy-missing-state", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": null, "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 499, "conditionText": "not(extract('CA10Z1__logStatus__c') == 'Enabled')" } }, { "Id": "legacy-unknown-retention", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Other", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 1000, "conditionText": "otherwise" } }, { "Id": "legacy-missing-retention", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": null, "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 1000, "conditionText": "otherwise" } }, { "Id": "legacy-vnet", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 7, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "INAPPLICABLE", "runtimeError": null, "conditionIndex": 199, "conditionText": "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id": "legacy-subnet", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/subnet", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 7, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "INAPPLICABLE", "runtimeError": null, "conditionIndex": 199, "conditionText": "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id": "legacy-nic", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkInterfaces/nic", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 7, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "INAPPLICABLE", "runtimeError": null, "conditionIndex": 199, "conditionText": "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id": "legacy-unknown-target", "CA10Z1__targetResourceId__c": "/unknown", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 299, "conditionText": "not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))" } }, { "Id": "legacy-missing-target", "CA10Z1__targetResourceId__c": null, "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 90, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": null, "expectedResult": { "status": "UNDETERMINED", "runtimeError": null, "conditionIndex": 299, "conditionText": "not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))" } }, { "Id": "legacy-disappeared", "CA10Z1__targetResourceId__c": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c": "Enabled", "CA10Z1__retentionPolicyDays__c": 7, "CA10Z1__retentionPolicyStatus__c": "Enabled", "CA10Z1__disappearanceTime__c": "2026-10-01T00:00:00Z", "expectedResult": { "status": "DISAPPEARED", "runtimeError": null, "conditionIndex": 99, "conditionText": "isDisappeared(CA10Z1__disappearanceTime__c)" } } ] - path: /types/CA10Z1__CaAzureNetworkWatcherFlowLog__c/object.extracts.yaml md5Hash: 4C7C498597206EEA400B79CFD86C117E content: | --- extracts: # Nullable. Text field. - name: "CA10Z1__logStatus__c" value: FIELD: path: "CA10Z1__logStatus__c" # Nullable. Text field. - name: "CA10Z1__retentionPolicyStatus__c" value: FIELD: path: "CA10Z1__retentionPolicyStatus__c" # Nullable. Number field. - name: "CA10Z1__retentionPolicyDays__c" value: FIELD: path: "CA10Z1__retentionPolicyDays__c" # Native resource ID identifies the flow-log target type. - name: CA10Z1__targetResourceId__c value: FIELD: path: CA10Z1__targetResourceId__c script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "legacy-89", "expectedResult" : { "status" : "INCOMPLIANT", "runtimeError" : null, "conditionIndex" : 799, "conditionText" : "extract('CA10Z1__retentionPolicyDays__c') < number(90.0)" } }, { "Id" : "legacy-90", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 899, "conditionText" : "extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'" } }, { "Id" : "legacy-91", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 899, "conditionText" : "extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'" } }, { "Id" : "legacy-zero", "expectedResult" : { "status" : "COMPLIANT", "runtimeError" : null, "conditionIndex" : 699, "conditionText" : "extract('CA10Z1__retentionPolicyDays__c') == number(0.0)" } }, { "Id" : "legacy-disabled-migration-unknown", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 399, "conditionText" : "extract('CA10Z1__logStatus__c') == 'Disabled'" } }, { "Id" : "legacy-disabled-retention", "expectedResult" : { "status" : "INCOMPLIANT", "runtimeError" : null, "conditionIndex" : 999, "conditionText" : "extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled'" } }, { "Id" : "legacy-missing-days", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 599, "conditionText" : "extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)" } }, { "Id" : "legacy-negative-days", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 599, "conditionText" : "extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)" } }, { "Id" : "legacy-unknown-state", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 499, "conditionText" : "not(extract('CA10Z1__logStatus__c') == 'Enabled')" } }, { "Id" : "legacy-missing-state", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 499, "conditionText" : "not(extract('CA10Z1__logStatus__c') == 'Enabled')" } }, { "Id" : "legacy-unknown-retention", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 1000, "conditionText" : "otherwise" } }, { "Id" : "legacy-missing-retention", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 1000, "conditionText" : "otherwise" } }, { "Id" : "legacy-vnet", "expectedResult" : { "status" : "INAPPLICABLE", "runtimeError" : null, "conditionIndex" : 199, "conditionText" : "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id" : "legacy-subnet", "expectedResult" : { "status" : "INAPPLICABLE", "runtimeError" : null, "conditionIndex" : 199, "conditionText" : "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id" : "legacy-nic", "expectedResult" : { "status" : "INAPPLICABLE", "runtimeError" : null, "conditionIndex" : 199, "conditionText" : "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')" } }, { "Id" : "legacy-unknown-target", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 299, "conditionText" : "not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))" } }, { "Id" : "legacy-missing-target", "expectedResult" : { "status" : "UNDETERMINED", "runtimeError" : null, "conditionIndex" : 299, "conditionText" : "not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))" } }, { "Id" : "legacy-disappeared", "expectedResult" : { "status" : "DISAPPEARED", "runtimeError" : null, "conditionIndex" : 99, "conditionText" : "isDisappeared(CA10Z1__disappearanceTime__c)" } } ]; """; CREATE TEMP FUNCTION mock_CA10Z1__CaAzureNetworkWatcherFlowLog__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 89, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-89" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-90" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 91, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-91" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 0, "CA10Z1__retentionPolicyStatus__c" : "Disabled", "Id" : "legacy-zero" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Disabled", "CA10Z1__retentionPolicyDays__c" : 7, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-disabled-migration-unknown" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Disabled", "Id" : "legacy-disabled-retention" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : null, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-missing-days" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : -1, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-negative-days" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Other", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-unknown-state" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : null, "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-missing-state" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Other", "Id" : "legacy-unknown-retention" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : null, "Id" : "legacy-missing-retention" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 7, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-vnet" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/subnet", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 7, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-subnet" }, { "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkInterfaces/nic", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 7, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-nic" }, { "CA10Z1__targetResourceId__c" : "/unknown", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-unknown-target" }, { "CA10Z1__targetResourceId__c" : null, "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 90, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-missing-target" }, { "CA10Z1__disappearanceTime__c" : new Date("2026-10-01T00:00:00Z"), "CA10Z1__targetResourceId__c" : "/subscriptions/s/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg", "CA10Z1__logStatus__c" : "Enabled", "CA10Z1__retentionPolicyDays__c" : 7, "CA10Z1__retentionPolicyStatus__c" : "Enabled", "Id" : "legacy-disappeared" } ]; """; CREATE TEMP FUNCTION process_CA10Z1__CaAzureNetworkWatcherFlowLog__c( obj STRUCT< CA10Z1__disappearanceTime__c TIMESTAMP, CA10Z1__targetResourceId__c STRING, CA10Z1__logStatus__c STRING, CA10Z1__retentionPolicyDays__c FLOAT64, CA10Z1__retentionPolicyStatus__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var IsEmptyLib = new function () { this.simpleIsEmpty = function(arg) { return arg == null; }; this.simpleIsNotEmpty = function(arg) { return arg != null; }; }(); var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Azure [CA10Z1__disappearanceTime__c]: ' + obj.CA10Z1__disappearanceTime__c); if (obj.CA10Z1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10Z1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function extract3() { if (!this.out) { this.out = obj.CA10Z1__targetResourceId__c; } return this.out; }; references1.push('Target Resource ID [obj.CA10Z1__targetResourceId__c]: ' + obj.CA10Z1__targetResourceId__c); if (TextLib.contains(extract3.call(extract3), '/virtualNetworks/') || TextLib.contains(extract3.call(extract3), '/networkInterfaces/')) { return {status: 'INAPPLICABLE', conditionIndex: 199, conditionText: "extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')", currentStateMessage: "This flow log targets a virtual network, subnet or interface.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[2], conditionIndex:[200..299] function extract7() { if (!this.out) { this.out = obj.CA10Z1__targetResourceId__c; } return this.out; }; if (!TextLib.contains(extract7.call(extract7), '/networkSecurityGroups/')) { return {status: 'UNDETERMINED', conditionIndex: 299, conditionText: "not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))", currentStateMessage: "The flow log target cannot be identified as an NSG.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[3], conditionIndex:[300..399] function extract10() { if (!this.out) { this.out = obj.CA10Z1__logStatus__c; } return this.out; }; references1.push('Log Status [obj.CA10Z1__logStatus__c]: ' + obj.CA10Z1__logStatus__c); if (TextLib.equal(extract10.call(extract10), 'Disabled')) { return {status: 'UNDETERMINED', conditionIndex: 399, conditionText: "extract('CA10Z1__logStatus__c') == 'Disabled'", currentStateMessage: "The disabled legacy log needs migration review before its scope can be determined.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[4], conditionIndex:[400..499] function extract13() { if (!this.out) { this.out = obj.CA10Z1__logStatus__c; } return this.out; }; if (!TextLib.equal(extract13.call(extract13), 'Enabled')) { return {status: 'UNDETERMINED', conditionIndex: 499, conditionText: "not(extract('CA10Z1__logStatus__c') == 'Enabled')", currentStateMessage: "The flow log enablement state is missing or unexpected.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[5], conditionIndex:[500..599] function extract16() { if (!this.out) { this.out = obj.CA10Z1__retentionPolicyDays__c; } return this.out; }; references1.push('Retention Policy: Days [obj.CA10Z1__retentionPolicyDays__c]: ' + obj.CA10Z1__retentionPolicyDays__c); if (IsEmptyLib.simpleIsEmpty(extract16.call(extract16)) || (extract16.call(extract16) != null && 0.0 != null && extract16.call(extract16) < 0.0)) { return {status: 'UNDETERMINED', conditionIndex: 599, conditionText: "extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)", currentStateMessage: "The legacy flow log retention days are missing or invalid.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[6], conditionIndex:[600..699] function extract21() { if (!this.out) { this.out = obj.CA10Z1__retentionPolicyDays__c; } return this.out; }; if (extract21.call(extract21) == 0.0) { return {status: 'COMPLIANT', conditionIndex: 699, conditionText: "extract('CA10Z1__retentionPolicyDays__c') == number(0.0)", currentStateMessage: "The enabled legacy flow log retains records indefinitely.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[7], conditionIndex:[700..799] function extract25() { if (!this.out) { this.out = obj.CA10Z1__retentionPolicyDays__c; } return this.out; }; if (extract25.call(extract25) != null && 90.0 != null && extract25.call(extract25) < 90.0) { return {status: 'INCOMPLIANT', conditionIndex: 799, conditionText: "extract('CA10Z1__retentionPolicyDays__c') < number(90.0)", currentStateMessage: "The enabled legacy flow log retention is shorter than 90 days.", currentStateReferences: references1.join('\n'), remediation: "Set retention to 0 or at least 90 days.", runtimeError: null}; } // condition[8], conditionIndex:[800..899] function extract28() { if (!this.out) { this.out = obj.CA10Z1__retentionPolicyStatus__c; } return this.out; }; references1.push('Retention Policy: Status [obj.CA10Z1__retentionPolicyStatus__c]: ' + obj.CA10Z1__retentionPolicyStatus__c); if (TextLib.equal(extract28.call(extract28), 'Enabled')) { return {status: 'COMPLIANT', conditionIndex: 899, conditionText: "extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'", currentStateMessage: "The enabled legacy flow log retains records for at least 90 days.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[9], conditionIndex:[900..999] function extract31() { if (!this.out) { this.out = obj.CA10Z1__retentionPolicyStatus__c; } return this.out; }; if (TextLib.equal(extract31.call(extract31), 'Disabled')) { return {status: 'INCOMPLIANT', conditionIndex: 999, conditionText: "extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled'", currentStateMessage: "The legacy flow log retention policy is disabled with nonzero retention days.", currentStateReferences: references1.join('\n'), remediation: "Set retention to 0, or enable retention for at least 90 days.", runtimeError: null}; } return {status: 'UNDETERMINED', conditionIndex: 1000, conditionText: "otherwise", currentStateMessage: "The retention policy enablement state is missing or unexpected.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__targetResourceId__c AS CA10Z1__targetResourceId__c, sObject.CA10Z1__logStatus__c AS CA10Z1__logStatus__c, sObject.CA10Z1__retentionPolicyDays__c AS CA10Z1__retentionPolicyDays__c, sObject.CA10Z1__retentionPolicyStatus__c AS CA10Z1__retentionPolicyStatus__c, sObject.Id AS Id, process_CA10Z1__CaAzureNetworkWatcherFlowLog__c( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__targetResourceId__c AS CA10Z1__targetResourceId__c, sObject.CA10Z1__logStatus__c AS CA10Z1__logStatus__c, sObject.CA10Z1__retentionPolicyDays__c AS CA10Z1__retentionPolicyDays__c, sObject.CA10Z1__retentionPolicyStatus__c AS CA10Z1__retentionPolicyStatus__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10Z1__CaAzureNetworkWatcherFlowLog__c()) AS sObject ) sObject ON sObject.Id = expectedResult.Id;