| name | cis-azure-foundations-7.8 |
| description | Ensure virtual network flow log retention days is >= 90 |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","nsg"] |
| cis_id | 7.8 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.5","cis-azure-foundations-7.6"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure virtual network flow log retention days is >= 90
Description
Ensure that virtual network flow logs are retained for greater than or equal to 90 days.
Rationale
Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.
Impact
- Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription.
- If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates.
- The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.
Audit Procedure
Using Azure Portal
- Go to
Network Watcher.
- Under
Logs, select Flow logs.
- Click
Add filter.
- From the
Filter drop-down menu, select Flow log type.
- From the
Value drop-down menu, check Virtual network only.
- Click
Apply.
- Click the name of a virtual network flow log.
- Under
Storage Account, ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
- Repeat steps 7 and 8 for each virtual network flow log.
Using Azure CLI
Run the following command to list network watchers:
az network watcher list
Run the following command to list the name and retention policy of flow logs in a network watcher:
az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]
For each flow log, ensure that days is set to 0, 90, or a number greater than 90. If days is set to 0, the logs are retained indefinitely with no retention policy.
Repeat for each network watcher.
Expected Result
All virtual network flow logs should have retention days set to (indefinite) or days.
