Check for NSG Flow Log Retention Period

01 Sign in to Azure Management Console.

02 Navigate to Network Watcher blade at https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview.

03 In the navigation panel, under Logs, click NSG flow logs to access all Azure NSG flow logs.

04 On the NSG flow logs page, choose the Azure subscription that you want to examine from the Subscription dropdown list.

05 Click on the active Network Security Group flow log that you want to examine to access the flow log configuration details. An active NSG flow log has the STATUS set to Enabled.

06 On the selected NSG flow log settings page, check the Retention (days) setting value. If this value (days) is less than 90 and different from 0 (unlimited retention), the flow log associated with the selected Azure Network Security Group does not have a sufficient log data retention period configured.

07 Repeat steps no. 5 and 6 for each active NSG flow log available in the current subscription.

08 Repeat steps no. 4 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run network nsg list command (Windows/macOS/Linux) using custom query filters to list the names of all network security groups and their associated resource groups, available in the current Azure subscription:

az network nsg list
	--output table
	--query '[*].{name:name, resourceGroup:resourceGroup}'

02 The command output should return a table with requested resource information:

Name                ResourceGroup
-----------------   ------------------------------
cc-production-nsg   cloud-shell-storage-westeurope
cc-sec-ops-nsg      cloud-shell-storage-westeurope

03 Run network watcher flow-log show command (Windows/macOS/Linux) command using the name of the network security group that you want to examine as identifier parameter and custom query filters to get the status and the retention period configured for the flow log associated with the selected Azure NSG:

az network watcher flow-log show
	--nsg cc-production-nsg
	--resource-group cloud-shell-storage-westeurope
	--query 'retentionPolicy'

04 The command output should return the feature status and the number of days to retain flow log data:

{
  "enabled": true,
  "days": 7
}

05 Repeat step no. 3 and 4 for each NSG flow log enabled within the current subscription.

06 Repeat steps no. 1 – 5 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to Azure Management Console.

02 Navigate to Network Watcher blade at https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview.

03 In the navigation panel, under Logs, click NSG flow logs to access all Azure NSG flow logs.

04 On the NSG flow logs page, choose the Azure subscription that you want to access from the Subscription dropdown list.

05 Click on the active Network Security Group flow log that you want to reconfigure (see Audit section part I to identify the right log). An active Network Security Group flow log has the STATUS set to Enabled.

06 On the selected flow log settings page, set the number of days to retain flow log data for the specified NSG in the Retention (Days) box to 90 days or more, or use the slider control to set the right value. Click Save to apply the retention period changes.

07 Repeat steps no. 5 and 6 for each active NSG flow log that you want to reconfigure, available in the current subscription.

08 Repeat steps no. 4 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run network watcher flow-log configure command (Windows/macOS/Linux) using the name of the associated NSG and the name of the required resource group as identifier parameter (see Audit section part II to identify the right NSG resource), to extend the retention period for flow log data recorded for the selected Azure Network Security Group. For example, the following command request sets a retention period of 140 days for any flow logs recorded under the specified NSG:

az network watcher flow-log configure
	--nsg cc-production-nsg
	--resource-group cloud-shell-storage-westeurope
	--enabled true
	--retention 120
	--storage-account abcdabcdabcdabcdabcd
	--workspace cc-log-analytics-workspace

02 The command output should return the modified NSG flow log configuration metadata:

{
  "enabled": true,
  "flowAnalyticsConfiguration": {
    "networkWatcherFlowAnalyticsConfiguration": {
      "enabled": true,
      "workspaceRegion": "westeurope",
      "workspaceResourceId": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.OperationalInsights/workspaces/cc-log-analytics-workspace"
    }
  },

  ...

  "retentionPolicy": {
    "days": 140,
    "enabled": true
  },
  "storageId": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcdabcdabcdabcdabcd",
  "targetResourceId": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/networkSecurityGroups/cc-production-nsg"
}

03 Repeat step no. 1 and 2 for each active NSG flow log that you want to reconfigure, available in the selected subscription.

04 Repeat steps no. 1 – 3 for each subscription created within your Microsoft Azure cloud account.