Control: 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days.
Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches. By default, Network Security Group Flow Logs are disabled.
- Login to Azure console, go to Network Watcher
NSG flow logsblade in the Logs section
- Select each
Network Security Groupfrom the list
Statusis set to On
Retention (days)setting greater than
- Select your storage account in the Storage account field
- Select Save
From Command Line
Enable the NSG flow logs and set the Retention (days) to greater than or equal to 90 days.
az network watcher flow-log configure --nsg <NameorID of the Network SecurityGroup> --enabled true --resource-group <resourceGroupName> --retention 91 -- storage-account <NameorID of the storage account to save flow logs>
steampipe check azure_compliance.control.cis_v130_6_4
This control uses a named query:network_sg_flowlog_retention_period_greater_than_90