Skip to main content

🛡️ Azure Network Security Group Flow Logs retention period is less than 90 days🟢

  • Contextual name: 🛡️ Security Group Flow Logs retention period is less than 90 days🟢
  • ID: /ce/ca/azure/virtual-network/security-group-flow-logs-retention-period-over-90-days
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-e5c05d3e1

Description​

Open File

Description​

Consider migrating from network security group flow logs to virtual network flow logs.

Retirement Notice On September 30, 2027, network security group (NSG) flow logs will be retired. Starting June 30, 2025, it will no longer be possible to create new NSG flow logs. Azure recommends migrating to virtual network flow logs. Review https://azure.microsoft.com/en-gb/updates?id=Azure-NSG-flow-logs-Retirement for more information. For virtual network flow logs, consider applying the policy Azure Virtual Network Flow Logs retention period is less than 90 days in this section.

Rationale​

Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.

Impact​

This will keep IP traffic logs for longer than 90 days. First determine your need to retain data, then apply your selection here. As this is data stored for longer, your monthly storage costs will increase depending on your data use.

... see more

Remediation​

Open File

Remediation​

Migrate Network Security Group (NSG) Flow Logs to Virtual Network Flow Logs​

Azure Network Security Group (NSG) flow logs must be migrated to Azure Virtual Network flow logs. This process disables existing NSG flow logs and creates equivalent virtual network flow logs.

Generate Migration Files​

  1. In the Azure portal, navigate to Network Watcher.
  2. Under Logs, select Migrate flow logs.
  3. Select the subscriptions and regions containing the NSG flow logs to migrate.
  4. Select Download script and JSON file.

A ZIP file named MigrateFlowLogs.zip is downloaded.

Run the Migration Script​

  1. Extract MigrateFlowLogs.zip locally. The archive contains:

    • MigrationFromNsgToAzureFlowLogging.ps1
    • RegionSubscriptionConfig.json

  2. Run the migration script:

.\MigrationFromNsgToAzureFlowLogging.ps1
  1. Select Run analysis by entering 1.
  2. When prompted, provide the path to the configuration file:
.\RegionSubscriptionConfig.json
  1. Enter the number of threads to use, or press Enter to accept the default value (16).

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 CIS Azure v1.3.0 → 💼 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated _ Not supported, requires a manual assessment)11no data
💼 CIS Azure v1.4.0 → 💼 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated _ Will be supported in the future)11no data
💼 CIS Azure v1.5.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' - Level 2 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (Automated)1no data
💼 CIS Azure v5.0.0 → 💼 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90 (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration72no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)728no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)270no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)437no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4853no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)70no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)28no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)70no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)221no data
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence1421no data
💼 ISO/IEC 27001:2022 → 💼 8.6 Capacity management33no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events170no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events95no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events170no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked41no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1721no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44770no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81737no data