🛡️ Azure Legacy NSG Flow Logs are not sent to Log Analytics🟢⚪

• Contextual name: 🛡️ Legacy NSG Flow Logs are not sent to Log Analytics🟢⚪
• ID: /ce/ca/azure/network-watcher/legacy-network-security-group-flow-logs
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY, RELIABILITY, PERFORMANCE

Stats

not available

Description

Open File

Description

Existing NSG flow logs must remain enabled and send traffic analytics to a central Log Analytics workspace until migration to virtual network flow logs.

Audit

Manual assessment is required. In Network Watcher > Flow logs, select NSG targets and review every current log still in use for enabled logging, enabled traffic analytics and the intended workspace. Disabled logs left by verified migration are out of scope and should be deleted. If no NSG logs remain, apply the virtual network flow-log capture assessment.

Cloudaware collects target IDs, log status and workspace relationships but no migration marker or proof of replacement coverage. A disabled log alone cannot establish migration. Confirm migration records, workload coverage and receipt of logs in the intended workspace. The v6 assessment is separate because it does not contain these v7 scope alternatives.

References

1. https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate

Remediation

Open File

Remediation

For each existing NSG flow log still in use, enable logging and traffic analytics to the approved central Log Analytics workspace. Verify that records arrive and retain them for the required period. New NSG flow logs cannot be created after June 30, 2025.

For migrated workloads, verify replacement virtual network flow-log coverage and analytics before deleting confirmed disabled legacy leftovers. Do not re-enable migration leftovers. If no NSG flow logs remain, use the virtual network flow-log capture and retention assessments. Preserve migration records and a rollback plan before changing logging.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 6.1.1.5 Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics (LEGACY) (Manual)			1		no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			82		no data