Network security groups should have flow logs captured and sent to Log Analytics
Ensure that network flow logs are captured and fed into a central log analytics workspace. The powerpipe check is titled "Ensure that Network Security Group Flow logs are captured and sent to Log Analytics".
What this control checks
Network security groups must capture flow logs and send them to Log Analytics
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.nsg_network_watcher_flow_log_send_to_log_analytics.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 7.1.1.5 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
CIS Azure Benchmark v5.0.0: Mapped to 6.1.1.5 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
CIS Azure Benchmark v1.5.0: Mapped to 5.1.6 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
CIS Azure Benchmark v2.0.0: Mapped to 5.1.6 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
CIS Azure Benchmark v2.1.0: Mapped to 5.1.5 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
CIS Azure Benchmark v3.0.0: Mapped to 6.1.5 (Ensure that Network Security Group Flow logs are captured and sent to Log Analytics).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
nsg_network_watcher_flow_log_send_to_log_analytics - Powerpipe Control:
azure_compliance.control.nsg_network_watcher_flow_log_send_to_log_analytics
Last reviewed: 2026-10-14