🛡️ Azure Legacy NSG Flow Log retention is insufficient🟢

• Contextual name: 🛡️ Legacy NSG Flow Log retention is insufficient🟢
• ID: /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Network Watcher Flow Log
  • 🔌 Azure Network Watcher Flow Log - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Retain records from existing NSG flow logs still in use for at least 90 days, or indefinitely. NSG flow logs retire on September 30, 2027; new logs cannot be created after June 30, 2025.

Audit

This policy marks an Azure Network Watcher Flow Log targeting an NSG as INCOMPLIANT if it is enabled and retention is a positive value below 90, or nonzero retention is configured with its retention policy disabled. Enabled logs with retention 0, or an enabled retention policy of 90 or more, are COMPLIANT.

Virtual-network, subnet and interface targets are INAPPLICABLE.

Remediation

Open File

Remediation

In Network Watcher > Flow logs, identify the NSG log and verify whether its workload has migrated. For a legacy log still in use, set Status to On and Retention days to 0 (indefinite) or at least 90. Verify storage retention and ongoing collection.

az network watcher flow-log update \
    --location {{location}} \
    --name {{flow-log-name}} \
    --enabled true \
    --retention {{0-or-at-least-90}}

For a log left disabled by migration, verify that the replacement virtual network flow log covers the workload, is enabled and has suitable retention and traffic analytics. Delete the confirmed legacy leftover after verification; do not re-enable it. Disabled state alone is not proof of migration. Preserve migration records and existing stored evidence, and review the migration rollback plan before changing logging. Use the separate virtual network retention policy for the replacement. No new NSG flow log can be created after June 30, 2025.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.12 Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90 (LEGACY) (Automated)			1		no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			82		no data