lacework-global-634
This policy exists in addition to lacework-global-816. See Adjusted Controls - 6.6 Ensure that Network Watcher is 'Enabled' for details.
Ensure that Network Watcher is 'Enabled' (includes Reserved access regions) (Automated)
This rule has been changed to automated, see Automated Policies for CIS Azure 1.5.0 for details.
Profile Applicability
• Level 2
Description
lacework-global-816 supplements this policy by excluding Reserved access regions. If you do not use Reserved access regions, disable this policy and enable lacework-global-816.
Enable Network Watcher for physical regions in Azure subscriptions.
Rationale
Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.
Impact
There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.
Audit
From Azure Portal
- Go to
Network Watcher
. - Ensure that a network watcher is listed for each region.
From Azure CLI
az network watcher list --query "[].{Location:location,State:provisioningState}" -o table
This will list all network watchers and their provisioning state. Ensure provisioningState
is Succeeded
for each network watcher.
az account list-locations --query "[?metadata.regionType=='Physical'].{Name:name,DisplayName:regionalDisplayName}" -o table
This will list all physical regions that exist in the subscription. Compare this list to the previous one to ensure that for each region, a network watcher exists with provisioningState
set to Succeeded
.
From Azure Powershell
Get a list of Network Watchers
Get-AzNetworkWatcher
Make sure each watcher is set with the ProvisioningState
setting set to Succeeded
.
Remediation
Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support.
To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below.
From Azure Portal
- Go to Network Watcher.
- Click Create.
- Select a Region from the drop-down menu.
- Click Add.
From Azure CLI
az network watcher configure --locations <region> --enabled true --resource-group <resource_group>
References
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_list
https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-cli-latest#az_network_watcher_configure
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-3-enable-logging-for-azure-network-activities
https://azure.microsoft.com/en-ca/pricing/details/network-watcher/