| name | cis-azure-foundations-7.5 |
| description | Ensure network security group flow log retention days is >= 90 |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","nsg"] |
| cis_id | 7.5 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.6","cis-azure-foundations-7.8"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure network security group flow log retention days is >= 90
Description
Network security group flow logs should be enabled and the retention period set to greater than or equal to 90 days.
Retirement Notice: On September 30, 2027, network security group (NSG) flow logs will be retired. As of June 30, 2025, creating new NSG flow logs is no longer possible. Azure recommends migrating to virtual network flow logs. Review https://azure.microsoft.com/en-us/updates/?id=Azure-NSG-flow-logs-Retirement for more information.
For virtual network flow logs, consider applying the recommendation Ensure that virtual network flow log retention days is set to greater than or equal to 90 in this section.
Rationale
Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.
Impact
This will keep IP traffic logs for 90 days or longer. As a level 2 control, first determine your need to retain data, then apply your selection here. As this is data stored for a longer period, your monthly storage costs will increase depending on your data use.
Audit Procedure
Using Azure Portal
- Go to
Network Watcher.
- Under
Logs, select Flow logs.
- Click the name of a network security group flow log.
- Ensure that
Status is set to On.
- Ensure that
Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
- Repeat steps 1-5 for each network security group flow log.
Using Azure CLI
Run the following command to list network watchers:
az network watcher list
Run the following command to list the name and retention policy of flow logs in a network watcher:
az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]
For each network security group flow log, ensure that enabled is set to true, and days is set to 0, 90, or a number greater than 90. If is set to , the logs are retained indefinitely with no retention policy.
