6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'

Information

Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days.

Rationale:

Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.

Solution

From Azure Console

Go to Network Watcher

Select NSG flow logs blade in the Logs section

Select each Network Security Group from the list

Ensure Status is set to On

Ensure Retention (days) setting greater than 90 days

Select your storage account in the Storage account field

Select Save

Using Azure Command Line Interface 2.0
Enable the NSG flow logs and set the Retention (days) to greater than or equal to 90 days.

az network watcher flow-log configure --nsg <NameorID of the Network Security Group> --enabled true --resource-group <resourceGroupName> --retention 91 --storage-account <NameorID of the storage account to save flow logs>

Default Value:

By default, Network Security Group Flow Logs are disabled.

See Also

https://workbench.cisecurity.org/files/3459

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-8, CSCv7|6.4

Plugin: microsoft_azure

Control ID: af100d8be2e8c6ead4c1682a2e1e87d32e38afdda2a134e83a4136525e38afc7