---
title: >-
  Network Security Group Flow Log retention period should be 'greater than 90
  days'
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Network Security Group Flow Log
  retention period should be 'greater than 90 days'
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Network Security Group Flow Log retention period should be 'greater than 90 days'
 
## Description{% #description %}

Azure Network Watcher flow logs should be set to retain IP traffic logs for at least 90 days, so you can investigate anomalies and potential breaches. This rule evaluates every network security group and virtual network flow log in a Network Watcher.

A Network Watcher fails when any of its flow logs has its retention policy disabled, or keeps logs for 1 to 89 days. Retention of 0 days (logs kept indefinitely) or 90 days or more passes, and a Network Watcher without flow logs is skipped. For virtual network flow logs, CIS also accepts a disabled retention policy with retention days set to 0, but this rule fails that configuration.

## Remediation{% #remediation %}

Enable the retention policy on each flow log and set retention days to 0 or to 90 or more. See [Manage NSG flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-manage) or [Manage virtual network flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage).

## References{% #references %}

- [Manage NSG flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-manage)
- [Manage virtual network flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage)
- [az network watcher flow-log](https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)