lacework-global-634
6.6 Ensure that Network Watcher is 'Enabled' (Automated)
note
This rule has been changed to automated, see Automated Rules for CIS Azure 1.5.0 for details.
Profile Applicability
• Level 2
Description
Enable Network Watcher for Azure subscriptions.
Rationale
Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.
Impact
There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.
Audit
From Azure Portal
- Go to
Network Watcher
- Ensure that the
STATUS
is set toEnabled
From Azure CLI
az network watcher list
This will list all regions where provisioningState
is Succeeded
.
Then run
az account list-locations
This will list all regions that exist in the subscription. Compare this list to the previous one to ensure that for all regions, provisioningState
is set to Succeeded
.
From Azure Powershell
Get a list of Network Watchers
Get-AzNetworkWatcher
Make sure each watcher is set with the ProvisioningState
setting set to Succeeded
.
Remediation
Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support.
References
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_list
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_configure
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-3-enable-logging-for-azure-network-activities
https://azure.microsoft.com/en-ca/pricing/details/network-watcher/