Ensure virtual network flow log retention days is >= 90
Description
Ensure that virtual network flow logs are retained for greater than or equal to 90 days.
Rationale
Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.
Impact
- Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription.
- If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates.
- The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.
Audit Procedure
Using Azure Portal
- Go to
Network Watcher.
- Under
Logs, select Flow logs.
- Click
Add filter.
- From the
Filter drop-down menu, select Flow log type.
- From the
Value drop-down menu, check Virtual network only.
- Click
Apply.
- Click the name of a virtual network flow log.
- Under
Storage Account, ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
- Repeat steps 7 and 8 for each virtual network flow log.
Using Azure CLI
Run the following command to list network watchers:
az network watcher list
Run the following command to list the name and retention policy of flow logs in a network watcher:
az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]
For each flow log, ensure that days is set to 0, 90, or a number greater than 90. If days is set to 0, the logs are retained indefinitely with no retention policy.
Repeat for each network watcher.
Expected Result
All virtual network flow logs should have retention days set to 0 (indefinite) or >= 90 days.
Remediation
Remediate from Azure Portal
- Go to
Network Watcher.
- Under
Logs, select Flow logs.
- Click
Add filter.
- From the
Filter drop-down menu, select Flow log type.
- From the
Value drop-down menu, check Virtual network only.
- Click
Apply.
- Click the name of a virtual network flow log.
- Under
Storage Account, set Retention days to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
- Repeat steps 7 and 8 for each virtual network flow log requiring remediation.
Remediate from Azure CLI
Run the following command update the retention policy for a flow log in a network watcher, setting retention to 0, 90, or a number greater than 90:
az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days>
Repeat for each virtual network flow log requiring remediation.
Default Value
When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator.
Additional Information
As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.
References
- https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage
- https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 8.3 Ensure Adequate Audit Log Storage | x | x | x |
| v8 | 8.10 Retain Audit Logs | | x | x |
| v7 | 6.4 Ensure adequate storage for logs | | x | x |
MITRE ATT&CK Mappings
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|
| | M1047 |
Profile
Level 2 | Automated
