Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
network_watcher_enabledProvider: Azure
Service:
networkSeverity: HIGH
Categories:
logging, forensics-readyResource type:
microsoft.network/networkwatchersWhat this check verifies
Azure Network Watcher presence across the subscription’s regions. The assessment checks that a Network Watcher instance exists in every subscription location where resources may be deployed.Risk
Absent Network Watcher in a region creates blind spots in network telemetry and diagnostics, hindering detection of anomalies. Attackers can exploit unnoticed NSG or routing issues for lateral movement or data exfiltration, degrading confidentiality and availability and slowing incident triage.Recommendation
Enable Network Watcher in all regions and keep it enabled as your footprint expands. Apply defense in depth by centralizing network logs and analytics, enforce coverage with policy, and restrict tool access by least privilege. Align retention and monitoring to support timely detection and investigation.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az network watcher configure —resource-group NetworkWatcherRG —enabled true —locations <LOCATION_1> <LOCATION_2>
References
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v2-logging-threat-detection#lt-3-enable-logging-for-azure-network-activities
- https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Network/enable-network-watcher.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = network_watcher_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks