Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'

Description:

Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.

Rationale:

Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.

This will keep IP traffic logs for longer than 90 days. As a level 2, first determine your need to retain data, then apply your selection here. As this is data stored for longer, your monthly storage costs will increase depending on your data use.

From Azure Portal

1. Go to 'Network Watcher'
2. Select 'NSG flow logs' blade in the Logs section
3. Select each Network Security Group from the list
4. Ensure 'Status' is set to 'On'
5. Ensure 'Retention (days)' setting 'greater than 90 days'
6. Select your storage account in the 'Storage account' field
7. Select 'Save'

From Azure CLI

Enable the 'NSG flow logs' and set the Retention (days) to greater than or equal to 90 days.

az network watcher flow-log configure --nsg --enabled true --resource-group --retention 91 --storage-account