Skip to main content

🧠 Azure Legacy NSG Flow Log retention is insufficient - prod.logic.yaml🟢

Uses​

Test Results 🟢​

Generated at: 2026-11-14T12:03:55.443712707Z Open

ResultIdCondition IndexCondition TextRuntime Error
🟢legacy-89✔️ 799✔️ extract('CA10Z1__retentionPolicyDays__c') < number(90.0)✔️ null
🟢legacy-90✔️ 899✔️ extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'✔️ null
🟢legacy-91✔️ 899✔️ extract('CA10Z1__retentionPolicyStatus__c') == 'Enabled'✔️ null
🟢legacy-zero✔️ 699✔️ extract('CA10Z1__retentionPolicyDays__c') == number(0.0)✔️ null
🟢legacy-disabled-migration-unknown✔️ 399✔️ extract('CA10Z1__logStatus__c') == 'Disabled'✔️ null
🟢legacy-disabled-retention✔️ 999✔️ extract('CA10Z1__retentionPolicyStatus__c') == 'Disabled'✔️ null
🟢legacy-missing-days✔️ 599✔️ extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)✔️ null
🟢legacy-negative-days✔️ 599✔️ extract('CA10Z1__retentionPolicyDays__c').isEmpty() || extract('CA10Z1__retentionPolicyDays__c') < number(0.0)✔️ null
🟢legacy-unknown-state✔️ 499✔️ not(extract('CA10Z1__logStatus__c') == 'Enabled')✔️ null
🟢legacy-missing-state✔️ 499✔️ not(extract('CA10Z1__logStatus__c') == 'Enabled')✔️ null
🟢legacy-unknown-retention✔️ 1000✔️ otherwise✔️ null
🟢legacy-missing-retention✔️ 1000✔️ otherwise✔️ null
🟢legacy-vnet✔️ 199✔️ extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')✔️ null
🟢legacy-subnet✔️ 199✔️ extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')✔️ null
🟢legacy-nic✔️ 199✔️ extract('CA10Z1__targetResourceId__c').contains('/virtualNetworks/') || extract('CA10Z1__targetResourceId__c').contains('/networkInterfaces/')✔️ null
🟢legacy-unknown-target✔️ 299✔️ not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))✔️ null
🟢legacy-missing-target✔️ 299✔️ not(extract('CA10Z1__targetResourceId__c').contains('/networkSecurityGroups/'))✔️ null
🟢legacy-disappeared✔️ 99✔️ isDisappeared(CA10Z1__disappearanceTime__c)✔️ null

Generation Bundle​

FileMD5
Open/ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/policy.yaml4A75A7F113B1A1EF20884B965CAF7136
Open/ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yamlDB84F31F5A535E319C36A2070A7D8BA5
Open/ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/test-data.json2E36513CB47492AA7D1EA15F62CC85F8
Open/types/CA10Z1__CaAzureNetworkWatcherFlowLog__c/object.extracts.yaml4C7C498597206EEA400B79CFD86C117E

Available Commands​

repo-manager policies generate FULL /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/virtual-network/legacy-security-group-flow-logs-retention/prod.logic.yaml

Content​

Open File

---
inputType: CA10Z1__CaAzureNetworkWatcherFlowLog__c
importExtracts:
- file: /types/CA10Z1__CaAzureNetworkWatcherFlowLog__c/object.extracts.yaml
testData:
- file: test-data.json
conditions:
- status: INAPPLICABLE
  currentStateMessage: This flow log targets a virtual network, subnet or interface.
  check:
    OR:
      args:
      - CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /virtualNetworks/
      - CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /networkInterfaces/
- status: UNDETERMINED
  currentStateMessage: The flow log target cannot be identified as an NSG.
  check:
    NOT:
      arg:
        CONTAINS:
          arg:
            EXTRACT: CA10Z1__targetResourceId__c
          search:
            TEXT: /networkSecurityGroups/
- status: UNDETERMINED
  currentStateMessage: The disabled legacy log needs migration review before its scope can be determined.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__logStatus__c
      right:
        TEXT: Disabled
- status: UNDETERMINED
  currentStateMessage: The flow log enablement state is missing or unexpected.
  check:
    NOT:
      arg:
        IS_EQUAL:
          left:
            EXTRACT: CA10Z1__logStatus__c
          right:
            TEXT: Enabled
- status: UNDETERMINED
  currentStateMessage: The legacy flow log retention days are missing or invalid.
  check:
    OR:
      args:
      - IS_EMPTY:
          arg:
            EXTRACT: CA10Z1__retentionPolicyDays__c
      - LESS_THAN:
          left:
            EXTRACT: CA10Z1__retentionPolicyDays__c
          right:
            NUMBER: 0
- status: COMPLIANT
  currentStateMessage: The enabled legacy flow log retains records indefinitely.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyDays__c
      right:
        NUMBER: 0
- status: INCOMPLIANT
  currentStateMessage: The enabled legacy flow log retention is shorter than 90 days.
  check:
    LESS_THAN:
      left:
        EXTRACT: CA10Z1__retentionPolicyDays__c
      right:
        NUMBER: 90
  remediationMessage: Set retention to 0 or at least 90 days.
- status: COMPLIANT
  currentStateMessage: The enabled legacy flow log retains records for at least 90 days.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyStatus__c
      right:
        TEXT: Enabled
- status: INCOMPLIANT
  currentStateMessage: The legacy flow log retention policy is disabled with nonzero retention days.
  check:
    IS_EQUAL:
      left:
        EXTRACT: CA10Z1__retentionPolicyStatus__c
      right:
        TEXT: Disabled
  remediationMessage: Set retention to 0, or enable retention for at least 90 days.
otherwise:
  status: UNDETERMINED
  currentStateMessage: The retention policy enablement state is missing or unexpected.