Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
network_flow_log_more_than_90_daysProvider: Azure
Service:
networkSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
microsoft.network/networkwatchersWhat this check verifies
Azure Network Watcher has NSG flow logs enabled and configured to retain for at least90 days (or 0 for unlimited). The evaluation checks that flow logging is enabled and that the retention policy meets the required duration for each configured log.
Risk
Absent or short-retained NSG flow logs reduce visibility into IP flows, delaying detection of port scans, brute force, data exfiltration, and lateral movement. Forensics and accountability degrade, threatening confidentiality and integrity.Recommendation
Enable NSG flow logs and keep retention90 days (0 for unlimited). Restrict and monitor access to logs, store immutably, and stream to a SIEM to detect anomalies. Apply defense in depth and least privilege. Plan migration to Virtual network flow logs as NSG flow logs are being retired.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az network watcher flow-log create —location <LOCATION> —name <example_resource_name> —nsg <example_resource_id> —storage-account <example_resource_id> —retention 90
References
- https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log?view=azure-cli-latest
- https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview?tabs=Americas
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Network/sufficient-nsg-flow-log-retention-period.html
- https://support.icompaas.com/support/solutions/articles/62000229906-ensure-that-network-security-group-flow-log-retention-period-is-greater-than-90-days-
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = network_flow_log_more_than_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks