cis-azure-foundations-7-5

name	cis-azure-foundations-7.5
description	Ensure network security group flow log retention days is >= 90
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","networking","nsg"]
cis_id	7.5
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-7.6","cis-azure-foundations-7.8"]
prerequisites	[]
severity_boost	{}

Ensure network security group flow log retention days is >= 90

Description

Network security group flow logs should be enabled and the retention period set to greater than or equal to 90 days.

Retirement Notice: On September 30, 2027, network security group (NSG) flow logs will be retired. As of June 30, 2025, creating new NSG flow logs is no longer possible. Azure recommends migrating to virtual network flow logs. Review https://azure.microsoft.com/en-us/updates/?id=Azure-NSG-flow-logs-Retirement for more information.

For virtual network flow logs, consider applying the recommendation Ensure that virtual network flow log retention days is set to greater than or equal to 90 in this section.

Rationale

Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.

Impact

This will keep IP traffic logs for 90 days or longer. As a level 2 control, first determine your need to retain data, then apply your selection here. As this is data stored for a longer period, your monthly storage costs will increase depending on your data use.

Audit Procedure

Using Azure Portal

1. Go to Network Watcher.
2. Under Logs, select Flow logs.
3. Click the name of a network security group flow log.
4. Ensure that Status is set to On.
5. Ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
6. Repeat steps 1-5 for each network security group flow log.

Using Azure CLI

Run the following command to list network watchers:

az network watcher list

Run the following command to list the name and retention policy of flow logs in a network watcher:

az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]

For each network security group flow log, ensure that enabled is set to true, and days is set to 0, 90, or a number greater than 90. If is set to , the logs are retained indefinitely with no retention policy.