Azure Compliance ControlsAzure Network Watcher
Network security groups should have flow logs captured and sent to Log Analytics
Ensure that network flow logs are captured and fed into a central log analytics workspace. The powerpipe check is titled "Ensure that Network Security Group Flow logs are captured and sent to Log Analytics".
What this control checks
Network security groups must capture flow logs and send them to Log Analytics
Framework mappings
The clauses this control is mapped to in each framework.
- 7.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
nsg_network_watcher_flow_log_send_to_log_analytics - Powerpipe Control:
azure_compliance.control.nsg_network_watcher_flow_log_send_to_log_analytics
Last reviewed: 2026-10-14