Control: Network Watcher flow logs should have traffic analytics enabled
Description
Traffic analytics analyzes flow logs to provide insights into traffic flow in your Azure cloud. It can be used to visualize network activity across your Azure subscriptions and identify hot spots, identify security threats, understand traffic flow patterns, pinpoint network misconfigurations and more.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.network_watcher_flow_log_traffic_analytics_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.network_watcher_flow_log_traffic_analytics_enabled --shareSQL
This control uses a named query:
select sg.id resource, case when sg.enabled and traffic_analytics ->> 'enabled' = 'true' and (traffic_analytics ->> 'trafficAnalyticsInterval')::int between 10 and 60 then 'ok' else 'alarm' end as status, case when sg.enabled and traffic_analytics ->> 'enabled' = 'true' and (traffic_analytics ->> 'trafficAnalyticsInterval')::int between 10 and 60 then sg.name || ' flowlog traffic analytics enabled.' else sg.name || ' flowlog traffic analytics disabled.' end as reason , sg.resource_group as resource_group , sub.display_name as subscriptionfrom azure_network_watcher_flow_log as sg join azure_subscription sub on sub.subscription_id = sg.subscription_id;