Azure Audit Networksecurity Security Group Flow Logs With

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of Security Group Flow Logs retention for a longer duration in AZURE:

Log in to the AZURE portal (https://portal.azure.com/).
Navigate to the "Security Center" from the left-hand menu.
Click on the "Security policy" option from the "Security Center" menu.
Click on the "Edit" button to edit the security policy.
Scroll down to the "Network security group flow logs" section and click on the "Edit" button.
In the "Retention period" field, enter the desired number of days for which you want to retain the logs.
Click on the "Save" button to save the changes.

Once you have completed these steps, the Security Group Flow Logs retention period will be updated to the desired duration. It is recommended to retain the logs for a longer duration for security and compliance purposes.

Using CLI

To remediate the misconfiguration of Security Group Flow Logs retention for a longer duration in Azure using Azure CLI, follow the below steps:

Open the Azure CLI command prompt.
Run the following command to set the retention period for Security Group Flow Logs as per your requirement:
```
az network watcher flow-log configure --nsg-flow-analytics true --enabled true --storage-account <storage_account_name> --interval 10 --retention 365
```
In the above command, replace <storage_account_name> with the name of the storage account where you want to retain the logs. You can also change the retention period (in days) as per your organization's requirements.
Once the command is executed successfully, Security Group Flow Logs will be retained for the specified duration.

Note: Make sure that you have the required permissions to configure Security Group Flow Logs in Azure.

Using Python

To remediate the misconfiguration of Security Group Flow Logs retention for a longer duration in Azure, you can use the following steps:

First, you need to log in to your Azure account using the Azure CLI. You can install and authenticate the Azure CLI using the following command:

az login

Once you are logged in, you need to retrieve the current retention period for Security Group Flow Logs using the following command:

az network watcher flow-log show --resource-group <resource-group-name> --name <flow-log-name> --query retentionEnabled

This command will return the current retention period for Security Group Flow Logs in Azure.

If the retention period is less than the required duration, you can use the following command to update the retention period:

az network watcher flow-log update --resource-group <resource-group-name> --name <flow-log-name> --retention <retention-duration>

Here, you need to replace <resource-group-name> with the name of the resource group where the Security Group Flow Logs are stored, <flow-log-name> with the name of the flow log, and <retention-duration> with the required retention period in days.

If you want to automate this process using Python, you can use the Azure SDK for Python. First, you need to install the Azure SDK using the following command:

pip install azure-mgmt-network

Once the Azure SDK is installed, you can use the following Python code to update the retention period for Security Group Flow Logs:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.network import NetworkManagementClient

# Replace the variables with your own values
subscription_id = '<subscription-id>'
resource_group_name = '<resource-group-name>'
flow_log_name = '<flow-log-name>'
retention_duration = '<retention-duration>'

# Authenticate using a service principal
credentials = ServicePrincipalCredentials(
    client_id='<client-id>',
    secret='<client-secret>',
    tenant='<tenant-id>'
)

# Create a NetworkManagementClient
network_client = NetworkManagementClient(credentials, subscription_id)

# Get the current retention period
flow_log = network_client.flow_logs.get(resource_group_name, flow_log_name)
current_retention = flow_log.retention_policy.enabled

# Update the retention period if required
if current_retention < retention_duration:
    flow_log.retention_policy.enabled = retention_duration
    network_client.flow_logs.create_or_update(resource_group_name, flow_log_name, flow_log)

Here, you need to replace the variables with your own values. Once you run this code, it will retrieve the current retention period for Security Group Flow Logs and update it if required.

Using Terraform

provider "azurerm" {
  features {}
}

# Existing NSG whose flow logs you want to retain longer
resource "azurerm_network_security_group" "example" {
  name                = "EXISTING_NSG_NAME"          # replace with your NSG name
  location            = "AZURE_REGION"               # e.g. "eastus"
  resource_group_name = "NSG_RESOURCE_GROUP_NAME"    # replace with your RG name
}

# Network Watcher required for NSG flow logs
resource "azurerm_network_watcher" "example" {
  name                = "network-watcher-EXISTING"
  location            = azurerm_network_security_group.example.location
  resource_group_name = "NETWORK_WATCHER_RG_NAME"    # replace with your watcher RG
}

# Storage account where flow logs will be written
resource "azurerm_storage_account" "flow_logs" {
  name                     = "FLOWLOGSSTORAGEACCOUNT" # must be globally unique, 3–24 lowercase letters/numbers
  resource_group_name      = azurerm_network_watcher.example.resource_group_name
  location                 = azurerm_network_watcher.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# NSG flow logging with sufficient retention
resource "azurerm_network_watcher_flow_log" "nsg_flow_log" {
  name                 = "nsg-flowlog-EXISTING_NSG_NAME"  # any valid name
  network_watcher_name = azurerm_network_watcher.example.name
  resource_group_name  = azurerm_network_watcher.example.resource_group_name

  network_security_group_id = azurerm_network_security_group.example.id
  storage_account_id        = azurerm_storage_account.flow_logs.id
  enabled                   = true

  retention_policy {
    enabled = true
    days    = 90  # minimum required; increase if you need longer retention
  }

  traffic_analytics {
    enabled               = true
    workspace_id          = "LOG_ANALYTICS_WORKSPACE_ID"          # replace with your workspace ID
    workspace_region      = "LOG_ANALYTICS_WORKSPACE_REGION"      # e.g. "eastus"
    workspace_resource_id = "LOG_ANALYTICS_WORKSPACE_RESOURCE_ID" # full resource ID
    interval_in_minutes   = 60
  }
}

Changing retention_policy.days from a lower value to 90 will be applied in place and does not replace the NSG; the flow log resource is updated without outage.

To verify, run terraform plan and ensure it shows an in-place update to azurerm_network_watcher_flow_log.nsg_flow_log with retention_policy.days changing from its previous value to 90 (or higher).

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation