Description

This detector identifies Azure PostgreSQL databases with insufficient log retention periods configured. When log retention is set to less than 4 days, it limits the ability to perform security investigations and audit historical database activities, potentially impacting incident response capabilities.

Detection Strategy

• Retrieves the 'log_retention_days' configuration for all Azure PostgreSQL databases in the subscription

• Checks if the configured retention period is less than 4 days

• Reports a vulnerability if any database has retention days set below the minimum threshold