Control: 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90

Description

Network security group flow logs should be enabled and the retention period set to greater than or equal to 90 days.

Retirement Notice

On September 30, 2027, network security group (NSG) flow logs will be retired. As of June 30, 2025, creating new NSG flow logs is no longer possible. Azure recommends migrating to virtual network flow logs. Review https://azure.microsoft.com/enus/updates?id=Azure-NSG-flow-logs-Retirement for more information. For virtual network flow logs, consider applying the recommendation Ensure that virtual network flow log retention days is set to greater than or equal to 90 in this section.

Remediation

Remediate from Azure Portal

Go to Network Watcher.
Under Logs, select Flow logs.
Click the name of a network security group flow log.
Set Status to On.
Set Retention days to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy.
Click Save.
Repeat steps 1-6 for each network security flow log requiring remediation.

Remediate from Azure CLI

For each network security group flow log requiring remediation, run the following command to enable the flow log and set retention to 0, 90, or a number greater than 90:

az network watcher flow-log configure --nsg <network-security-group> --enabled true --resource-group <resource-group> --retention <number-of-days> --storage-account <storage-account>

Default Value

By default, network security group flow logs are disabled.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_7_5

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_7_5 --share

SQL

This control uses a named query:

select
  sg.id resource,
  case
    when fl.id is null or not fl.enabled or fl.retention_policy_days < 90 then 'alarm'
    else 'ok'
  end as status,
  case
    when fl.id is null or not fl.enabled
      then sg.name || ' flowlog not enabled.'
    when fl.retention_policy_days < 90
      then sg.name || ' flowlog ' || fl.title || ' retention period is less than 90 days.'
    else sg.name || ' flowlog ' || fl.title || ' retention period is ' || fl.retention_policy_days || ' days.'
  end as reason
  
  , sg.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_network_security_group sg
  left join azure_network_watcher_flow_log fl on sg.id = fl.target_resource_id
  left join azure_subscription sub on sub.subscription_id = sg.subscription_id;

Control: 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90

Description

Remediation

Default Value

Usage

SQL

Tags