Defining a short log retention duration can reduce an organization’s ability to backtrace the actions of malicious actors in case of a security
incident.
Logging allows operational and security teams to get detailed and real-time feedback on an information system’s events. The logging coverage
enables them to quickly react to events, ranging from the most benign bugs to the most impactful security incidents, such as intrusions.
Apart from security detection, logging capabilities also directly influence future digital forensic analyses. For example, detailed logging will
allow investigators to establish a timeline of the actions perpetrated by an attacker.
Ask Yourself Whether
- This component is essential for the information system infrastructure.
- This component is essential for mission-critical functions.
- Compliance policies require traceability for a longer duration.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
Setting log retention period to 14 days is the bare minimum. It’s recommended to increase it to 30 days or above.
Sensitive Code Example
For Azure Firewall Policy:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/firewallPolicies",
"apiVersion": "2022-07-01",
"properties": {
"insights": {
"isEnabled": true,
"retentionDays": 7
}
}
}
]
}
resource firewallPolicy 'Microsoft.Network/firewallPolicies@2022-07-01' = {
properties: {
insights: {
isEnabled: true
retentionDays: 7 // Sensitive
}
}
}
Raise issue when retentionDays is smaller than 14, but not 0 (zero), or if isEnabled is
false or the insights block is missing.
For Microsoft Network Network Watchers Flow
Logs:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/networkWatchers/flowLogs",
"apiVersion": "2022-07-01",
"properties": {
"retentionPolicy": {
"days": 7,
"enabled": true
}
}
}
]
}
resource networkWatchersFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2022-07-01' = {
properties: {
retentionPolicy: {
days: 7
enabled: true
}
}
}
Raise issue when days is smaller than 14, but not 0 (zero), or if enabled is set to
false or retentionPolicy is missing.
For Microsoft SQL Servers Auditing
Settings:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Sql/servers/auditingSettings",
"apiVersion": "2021-11-01",
"properties": {
"retentionDays": 7
}
}
]
}
resource sqlServerAudit 'Microsoft.Sql/servers/auditingSettings@2021-11-01' = {
properties: {
retentionDays: 7 // Sensitive
}
}
Raise issue when retentionDays is smaller than 14, but not 0 (zero).
The same case applies to other types (when type field is set to one of following):
Compliant Solution
For Azure Firewall Policy:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/firewallPolicies",
"apiVersion": "2022-07-01",
"properties": {
"insights": {
"isEnabled": true,
"retentionDays": 30
}
}
}
]
}
resource firewallPolicy 'Microsoft.Network/firewallPolicies@2022-07-01' = {
properties: {
insights: {
isEnabled: true
retentionDays: 30 // Compliant
}
}
}
For Microsoft Network Network Watchers Flow
Logs:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/networkWatchers/flowLogs",
"apiVersion": "2022-07-01",
"properties": {
"retentionPolicy": {
"days": 30,
"enabled": true
}
}
}
]
}
resource networkWatchersFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2022-07-01' = {
properties: {
retentionPolicy: {
days: 30 // Compliant
enabled: true
}
}
}
For Microsoft SQL Servers Auditing
Settings:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Sql/servers/auditingSettings",
"apiVersion": "2021-11-01",
"properties": {
"retentionDays": 30
}
}
]
}
resource sqlServerAudit 'Microsoft.Sql/servers/auditingSettings@2021-11-01' = {
properties: {
retentionDays: 30 // Compliant
}
}
Above code also applies to other types defined in previous paragraph.
