cis-azure-foundations-7-8

name	cis-azure-foundations-7.8
description	Ensure virtual network flow log retention days is >= 90
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","networking","nsg"]
cis_id	7.8
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-7.5","cis-azure-foundations-7.6"]
prerequisites	[]
severity_boost	{}

Ensure virtual network flow log retention days is >= 90

Description

Ensure that virtual network flow logs are retained for greater than or equal to 90 days.

Rationale

Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.

Impact

• Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription.
• If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates.
• The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.

Audit Procedure

Using Azure Portal

1. Go to Network Watcher.
2. Under Logs, select Flow logs.
3. Click Add filter.
4. From the Filter drop-down menu, select Flow log type.
5. From the Value drop-down menu, check Virtual network only.
6. Click Apply.
7. Click the name of a virtual network flow log.
8. Under Storage Account, ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
9. Repeat steps 7 and 8 for each virtual network flow log.

Using Azure CLI

Run the following command to list network watchers:

az network watcher list

Run the following command to list the name and retention policy of flow logs in a network watcher:

az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]

For each flow log, ensure that days is set to 0, 90, or a number greater than 90. If days is set to 0, the logs are retained indefinitely with no retention policy.

Repeat for each network watcher.

Expected Result

All virtual network flow logs should have retention days set to (indefinite) or days.