Check ID: network_flow_log_more_than_90_days
Provider: Azure
Service: network
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: microsoft.network/networkwatchers

What this check verifies

Azure Network Watcher has NSG flow logs enabled and configured to retain for at least 90 days (or 0 for unlimited). The evaluation checks that flow logging is enabled and that the retention policy meets the required duration for each configured log.

Risk

Absent or short-retained NSG flow logs reduce visibility into IP flows, delaying detection of port scans, brute force, data exfiltration, and lateral movement. Forensics and accountability degrade, threatening confidentiality and integrity.

Recommendation

Enable NSG flow logs and keep retention 90 days (0 for unlimited). Restrict and monitor access to logs, store immutably, and stream to a SIEM to detect anomalies. Apply defense in depth and least privilege. Plan migration to Virtual network flow logs as NSG flow logs are being retired.

Remediation

az network watcher flow-log create —location <LOCATION> —name <example_resource_name> —nsg <example_resource_id> —storage-account <example_resource_id> —retention 90

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = network_flow_log_more_than_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks