standard
turbot/azure_cis
Get Involved
Version
Pipeline: 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
Description
Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.
Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches.
Remediation
From Azure Portal
- Go to
Network Watcher
. - Select
NSG flow logs
blade in the Logs section. - Select each Network Security Group from the list.
- Ensure
Status
is set toOn
. - Ensure
Retention (days)
settinggreater than 90 days
. - Select your storage account in the
Storage account
field. - Select
Save
.
From Azure CLI
Enable the NSG flow logs
and set the Retention (days) to greater than or equal to 90 days.
az network watcher flow-log configure --nsg <NameorID of the Network Security Group> --enabled true --resource-group <resourceGroupName> --retention 91 --storage-account <NameorID of the storage account to save flow logs>
Default Value
By default, Network Security Group Flow Logs are disabled
.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run azure_cis.pipeline.cis_v300_7_5
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = azure_cis.pipeline.cis_v300_7_5 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
Outputs
This pipeline has no outputs.
Tags
folder = CIS v3.0.0/7 Networking