Description:

Enable Network Watcher for Azure subscriptions.


Rationale:

Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.


Impact:

There are additional costs per transaction to run and store network data. For highvolume networks these charges will add up quickly.


Audit:


From Azure Portal

1. Go to Network Watcher

2. Ensure that the STATUS is set to Enabled


From Azure CLI

az network watcher list

This will list all regions where provisioningState is Succeeded. Then run

az account list-locations

This will list all regions that exist in the subscription. Compare this list to the previous one to ensure that for all regions, provisioningState is set to Succeeded.


From PowerShell

Get a list of Network Watchers

Get-AzNetworkWatcher


Make sure each watcher is set with the ProvisioningState setting set to Succeeded and all Locations are set with a watcher.


Remediation:

Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support.


Default Value:

Network Watcher is automatically enabled. When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for

automatically enabling Network Watcher.


References:

1. https://docs.microsoft.com/en-us/azure/network-watcher/network-watchermonitoring-overview

2. https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-clilatest#az_network_watcher_list

3. https://docs.azure.cn/zh-cn/cli/network/watcher?view=azure-clilatest#az_network_watcher_configure

4. https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create

5. https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-3-enable-logging-for-azure-network-activities

6. https://azure.microsoft.com/en-ca/pricing/details/network-watcher/