📝 Azure Network Security Group Flow Logs retention period is less than 90 days 🟢

• Contextual name: 📝 Security Group Flow Logs retention period is less than 90 days 🟢
• ID: /ce/ca/azure/virtual-network/security-group-flow-logs-retention-period-over-90-days
• Located in: 📁 Azure Virtual Network

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Check for NSG Flow Log Retention Period
• Internal
  • dec-x-e5c05d3e

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-e5c05d3e	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Network Security Group
  • 🔌 Azure Network Security Group - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.

Rationale

Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.

Impact

This will keep IP traffic logs for longer than 90 days. As a level 2, first determine your need to retain data, then apply your selection here. As this is data stored for longer, your monthly storage costs will increase depending on your data use.

Audit

From Azure Portal

1. Go to Network Watcher.
2. Select NSG flow logs blade in the Logs section.
3. Select each Network Security Group from the list.
4. Ensure Status is set to On.
5. Ensure Retention (days) setting greater than 90 days.

From Azure CLI

az network watcher flow-log show --resource-group <resourceGroup> --nsg <NameorID of the NetworkSecurityGroup> --query 'retentionPolicy'

Ensure that enabled is set to true and days is set to greater then or equal to 90.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Network Watcher.
2. Select NSG flow logs blade in the Logs section.
3. Select each Network Security Group from the list.
4. Ensure Status is set to On.
5. Ensure Retention (days) setting greater than 90 days.
6. Select your storage account in the Storage account field.
7. Select Save.

From Azure CLI

Enable the NSG flow logs and set the Retention (days) to greater than or equal to 90 days:

az network watcher flow-log configure --nsg <NameorID of the Network Security Group> --enabled true --resource-group <resourceGroupName> --retention 91 --storage-account <NameorID of the storage account to save flow logs>

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		18	21
💼 CIS Azure v1.3.0 → 💼 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated _ Not supported, requires a manual assessment)		1	1
💼 CIS Azure v1.4.0 → 💼 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated _ Will be supported in the future)		1	1
💼 CIS Azure v1.5.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (Automated)			1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			49
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)		7	23
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	4		21
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)			23
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)	2		17
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence		14	15
💼 ISO/IEC 27001:2022 → 💼 8.6 Capacity management		3	3
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			24
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions		15	16
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control	8	15	21