Ensure that the retention policy is enabled for Azure Network Watcher Flow Log

MEDIUM

Description

Retention Policy is not enabled for Azure Network Watcher Flow Log, this may lead to loss of case sensitive logs.

Remediation

At this time, the console UI does not have remediation steps available. For possible CLI remediation, see the product documentation (below) or use Terraform.

In Terraform -

  1. In the azurerm_monitor_log_profile resource, set categories in array.

References:
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile

Policy Details

Rule Reference ID: AC_AZURE_0415
CSP: Azure
Remediation Available: Yes
Domain: Resilience
Resource Category: Logging and Monitoring
Resource Type: Network Watcher

Frameworks