Network security groups should have flow logs configured
Audit for network security groups to verify if flow logs are configured. Enabling flow logs allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, and detecting intrusions.
Enabling flow logs allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, verifying compliance, detecting intrusions and more.
What this control checks
Network security groups must have flow logs configured (flowLogs count not equal to 0).
Common pitfalls
Effect can be set to Disabled
The effect parameter defaults to Audit. Its allowed values are Audit and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Flow logs should be configured for every network security group" (c251913d-7d24-4958-af87-478ed3b9ba41); PowerPipe controls azure_compliance.control.network_sg_flowlog_enabled and azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to DE.CM-01 (Networks and network services are monitored to find potentially adverse events.) and ID.AM-03 (Representations of the organization's authorized network communication and internal and external network data flows are...).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- 3.1.g Trails
- 5 Policy for Information System Audit (IS Audit)
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
Related controls
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Key vaults should have resource logs enabled
- Network security groups should limit inbound TCP port 3306 access from the internet
- Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations
- MySQL servers should have 'audit_log_events' configured to include 'CONNECTION'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_sg_flowlog_enabled - Powerpipe Controls:
azure_compliance.control.network_sg_flowlog_enabled,azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90 - Azure Policy Definition:
c251913d-7d24-4958-af87-478ed3b9ba41
Last reviewed: 2026-10-14