# Cis Azure Foundations 7.8

> Cis Azure Foundations 7.8 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure virtual network flow log retention days is >= 90

- Skill name: `cis-azure-foundations-7.8`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-7.8/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure virtual network flow log retention days is >= 90

## Description

Ensure that virtual network flow logs are retained for greater than or equal to 90 days.

## Rationale

Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.

## Impact

- Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription.
- If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates.
- The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.

## Audit Procedure

### Using Azure Portal

1. Go to `Network Watcher`.
2. Under `Logs`, select `Flow logs`.
3. Click `Add filter`.
4. From the `Filter` drop-down menu, select `Flow log type`.
5. From the `Value` drop-down menu, check `Virtual network` only.
6. Click `Apply`.
7. Click the name of a virtual network flow log.
8. Under `Storage Account`, ensure that `Retention days` is set to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy.
9. Repeat steps 7 and 8 for each virtual network flow log.

### Using Azure CLI

Run the following command to list network watchers:

```bash
az network watcher list
```

Run the following command to list the name and retention policy of flow logs in a network watcher:

```bash
az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy]
```

For each flow log, ensure that `days` is set to `0`, `90`, or a number greater than 90. If `days` is set to `0`, the logs are retained indefinitely with no retention policy.

Repeat for each network watcher.

## Expected Result

All virtual network flow logs should have retention days set to `0` (indefinite) or `>= 90` days.

## Remediation

### Remediate from Azure Portal

1. Go to `Network Watcher`.
2. Under `Logs`, select `Flow logs`.
3. Click `Add filter`.
4. From the `Filter` drop-down menu, select `Flow log type`.
5. From the `Value` drop-down menu, check `Virtual network` only.
6. Click `Apply`.
7. Click the name of a virtual network flow log.
8. Under `Storage Account`, set `Retention days` to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy.
9. Repeat steps 7 and 8 for each virtual network flow log requiring remediation.

### Remediate from Azure CLI

Run the following command update the retention policy for a flow log in a network watcher, setting `retention` to `0`, `90`, or a number greater than 90:

```bash
az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days>
```

Repeat for each virtual network flow log requiring remediation.

## Default Value

When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator.

## Additional Information

As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.

## References

1. https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage
2. https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log

## CIS Controls

| Controls Version | Control                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------- | ---- | ---- | ---- |
| v8               | 8.3 Ensure Adequate Audit Log Storage | x    | x    | x    |
| v8               | 8.10 Retain Audit Logs                |      | x    | x    |
| v7               | 6.4 Ensure adequate storage for logs  |      | x    | x    |

## MITRE ATT&CK Mappings

| Techniques / Sub-techniques | Tactics | Mitigations |
| --------------------------- | ------- | ----------- |
|                             |         | M1047       |

## Profile

Level 2 | Automated

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-foundations-7-8 (OpenParable). Cite the canonical URL above.