turbot/azure_compliance

Query: monitor_log_profile_retention_365_days

Usage

powerpipe query azure_compliance.query.monitor_log_profile_retention_365_days

SQL

select
p.id as resource,
case
when p.retention_policy ->> 'enabled' = 'false' then 'alarm'
when p.retention_policy ->> 'enabled' = 'true' and (p.retention_policy ->> 'days')::int >= 365 then 'ok'
else 'alarm'
end as status,
case
when p.retention_policy ->> 'enabled' = 'false' then p.name || ' retention policy disabled.'
else p.name || ' retention is set to ' || (p.retention_policy ->> 'days') || ' day(s).'
end as reason
, p.resource_group as resource_group
, sub.display_name as subscription
from
azure_log_profile as p
left join azure_subscription sub on sub.subscription_id = p.subscription_id;

Controls

The query is being used by the following controls: