Skip to main content

🛡️ Azure Subscription Network Watcher is not enabled in every region in use🟢⚪

  • Contextual name: 🛡️ Network Watcher is not enabled in every region in use🟢⚪
  • ID: /ce/ca/azure/subscription/network-watcher-in-every-available-region
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY, RELIABILITY

Stats​

not available

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-629108da1

Description​

Open File

Description​

Enable Network Watcher for physical regions in Azure subscriptions where network resources are in use.

Rationale​

Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.

Impact​

There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.

Audit​

Review the Network Watcher service and confirm that a Network Watcher exists with provisioningState set to Succeeded for each Azure region in use by the subscription.

Default Value​

Network Watcher is automatically enabled. When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for automatically enabling Network Watcher.

References​

  1. https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
  2. https://learn.microsoft.com/en-us/cli/azure/network/watcher?view=azure-cli-latest

... see more

Remediation​

Open File

Remediation​

Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support. To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below.

From Azure Portal​

  1. Go to Network Watcher.
  2. Click Create.
  3. Select a Region from the drop-down menu.
  4. Click Add.

From Azure CLI​

az network watcher configure \
    --locations {{region}} \
    --enabled true \
    --resource-group {{resource-group-name}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 73f response and recovery which involves a mixture of system restoration (where integrity and availability have been compromised) and managing sensitive data loss where confidentiality has been compromised. This allows for a return to businessas-usual processing;45no data
💼 CIS Azure v5.0.0 → 💼 7.6 Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 7.6 Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration79no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)239112no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)194no data
💼 ISO/IEC 27001:2022 → 💼 8.22 Segregation of networks44no data
💼 ISO/IEC 27001:2022 → 💼 8.27 Secure system architecture and engineering principles14no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events182no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained89no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected197no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage129no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3276131no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains3335no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information910no data