Description

This detector checks Azure Network Watcher Flow Logs for insufficient log retention periods and disabled retention policies. Flow logs are critical for network security monitoring and forensics, and inadequate retention periods can impact incident investigation capabilities and compliance requirements.

Detection Strategy

• Flags a vulnerability when the flow log retention period is set to less than 90 days

• Flags a vulnerability when the flow log retention policy is disabled (enabled = false)

• Examines each Network Watcher flow log configuration in the Azure subscription