Check Details

• Resource: Azure Virtual Network
• Check: Ensure Virtual Network Flow Logs Are Enabled
• Risk: Without flow logs, network activity cannot be monitored effectively for security analysis or incident response.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Network Watcher.
3. Under Logs, select Flow logs.
4. Click Create and select Virtual Network as the Flow Log type.
5. Select the appropriate Subscription and Virtual Network.
6. Choose a Storage Account to store the logs.
7. Ensure Flow Logs are set to On and click Review + Create.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Enable Network Watcher in the required region (if not already enabled):

   

   az network watcher configure \
    --locations <region> \
    --resource-group NetworkWatcherRG \
    --enabled true
   

3. Create and enable Virtual Network flow logs:

   

   az network watcher flow-log create \
    --resource-group NetworkWatcherRG \
    --name <flow-log-name> \
    --location <region> \
    --vnet <vnet-name> \
    --storage-account <storage-account-name> \
    --enabled true
   

4. Verify that Virtual Network flow logs are enabled:

   

   az network watcher flow-log show \
    --resource-group NetworkWatcherRG \
    --name <flow-log-name> \
    --location <region> \
    --query enabled
   

Replace <region>, <vnet-name>, <flow-log-name>, and <storage-account-name> with your actual values. The output should return true, confirming that flow logs are enabled.