Log Profile No Retention Policy

Risk Level: Low

Description:

This plugin enforces a log retention policy for Log Profiles. To aid in the investigation of previous security incidents and for compliance considerations, log retention rules should be configured with appropriate retention. The retention period represents the number of days to retain activity logs for a Microsoft Azure cloud subscription.

Recommended Action: Create a retention policy for log profiles.

About the Service :

Azure Monitor can help you improve the availability and performance of your apps and services. It provides a complete solution for gathering, evaluating, and responding to telemetry from the cloud and on-premises settings. This data enables you to better understand how your apps are doing and to detect concerns that may harm them or the resources they rely on in the future.

Impact: 

The unavailability of the log retention period will lead to an insufficient amount of necessary activity log data and we may face difficulty in finding any anomalies and potential security breaches.

Steps to Reproduce( Using Azure CLI ) :

1. Sign in to Azure CLI.
2. Run the command: “ az monitor log-profiles list ”. 
3. In the output check the retention policy,  if enabled is set to false, the vulnerability exists.
    
4. Repeat steps no. 2-3 for other subscriptions in your Microsoft Azure accounts.

Steps for Remediation( Using Azure CLI ) :

1. Sign in to Azure Management Console.
2. Update the log profile for recommended retention period using the following command :
   

   az monitor log-profiles update --name MyLogProfile --set retentionPolicy.days=<number_of_days>

3. 
4. Repeat steps no. 2-3 for other misconfigured log profiles.

References:

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics