Skip to main content

lacework-global-634

6.6 Ensure that Network Watcher is 'Enabled' (Automated)​

note

This rule has been changed to automated, see Automated Rules for CIS Azure 1.5.0 for details.

Profile Applicability​

• Level 2

Description​

Enable Network Watcher for physical regions in Azure subscriptions.

Rationale​

Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.

Impact​

There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.

Audit​

From Azure Portal​

  1. Go to Network Watcher.
  2. Ensure that a network watcher is listed for each region.

From Azure CLI​

az network watcher list --query "[].{Location:location,State:provisioningState}" -o table

This will list all network watchers and their provisioning state. Ensure provisioningState is Succeeded for each network watcher.

az account list-locations --query "[?metadata.regionType=='Physical'].{Name:name,DisplayName:regionalDisplayName}" -o table

This will list all physical regions that exist in the subscription. Compare this list to the previous one to ensure that for each region, a network watcher exists with provisioningState set to Succeeded.

From Azure Powershell​

Get a list of Network Watchers

Get-AzNetworkWatcher

Make sure each watcher is set with the ProvisioningState setting set to Succeeded.

Remediation​

Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support.

To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below.

From Azure Portal​

  1. Go to Network Watcher.
  2. Click Create.
  3. Select a Region from the drop-down menu.
  4. Click Add.

From Azure CLI​

az network watcher configure --locations <region> --enabled true --resource-group <resource_group>

References​

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_list
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_configure
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-3-enable-logging-for-azure-network-activities
https://azure.microsoft.com/en-ca/pricing/details/network-watcher/