Control: 7.1.1.7 Ensure that virtual network flow logs are captured and sent to Log Analytics

Description

Ensure that virtual network flow logs are captured and fed into a central log analytics workspace.

Virtual network flow logs provide critical visibility into traffic patterns. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.

Remediation

From Azure Portal

1. Go to Network Watcher.
2. Under Logs, click Flow logs.
3. Click + Create.
4. Select a subscription.
5. Next to Flow log type, select Virtual network.
6. Click + Select target resource.
7. Select Virtual network.
8. Select a virtual network.
9. Click Confirm selection.
10. Select a storage account, or create a new storage account.
11. Set the retention in days for the storage account.
12. Click Next.
13. Under Analytics, for Flow logs version, select Version 2.
14. Check the box next to Enable traffic analytics.
15. Select a processing interval.
16. Select a Log Analytics Workspace.
17. Click Next.
18. Optionally, add Tags.
19. Click Review + create.
20. Click Create.
21. Repeat steps 1-20 for each subscription or virtual network requiring remediation.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v400_7_1_1_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v400_7_1_1_7 --share

SQL

This control uses a named query:

with virtual_network_watcher_flow_log as (
  select
    subscription_id,
    count(*) as vn_flow_log_count
  from
    azure_network_watcher_flow_log
  where
    traffic_analytics -> 'workspaceId' is not null
    and target_resource_id like '%/Microsoft.Network/virtualNetworks/%'
  group by
    subscription_id
)
select
  sub.id resource,
  case
    when vn_flow_log_count > 0  then 'ok'
    else 'alarm'
  end as status,
  case
    when vn_flow_log_count > 0 then sub.display_name || ' has ' || vn_flow_log_count || ' virtual network flow log(s) captured and sent to log analytics.'
    else sub.display_name || ' has no virtual network flow log captured and sent to log analytics.'
  end as reason
  , display_name as subscription
from
  azure_subscription as sub
  left join virtual_network_watcher_flow_log as vn_flow_log on vn_flow_log.subscription_id = sub.subscription_id;

Tags