Network Watchers Not Enabled

More Info:

Ensure that Network Watcher service is enabled within your Azure account subscriptions to help you monitor and diagnose various conditions at the network level. Microsoft Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources within a virtual network.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS AZURE
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HIPAA
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the “Network Watchers Not Enabled” misconfiguration in Azure using the Azure console, follow these steps:

1. Log in to your Azure portal.
2. In the left-hand menu, click on “All services” and type “Network Watcher” in the search bar.
3. Click on “Network Watcher” to open the service.
4. In the left-hand menu of the Network Watcher service, click on “Network Watcher” again.
5. Click on the subscription that you want to enable Network Watcher for.
6. Click on “Enable Network Watcher” at the top of the page.
7. Select the region where you want to enable Network Watcher.
8. Click on “Enable” to enable Network Watcher for the selected region.
9. Repeat steps 7-8 for all the regions where you want to enable Network Watcher.
10. Once you have enabled Network Watcher for all the regions, click on “Network Watcher” in the left-hand menu again.
11. Click on “Topology” to verify that Network Watcher is now enabled.

By following these steps, you should be able to remediate the “Network Watchers Not Enabled” misconfiguration in Azure using the Azure console.

Using CLI

To remediate the misconfiguration of Network Watchers not enabled on Azure using Azure CLI, follow these steps:

1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.

2. Run the following command to check if Network Watchers are already enabled on your Azure subscription:

az network watcher list

3. If Network Watchers are not enabled, run the following command to enable them:

az feature register --namespace Microsoft.Network --name NetworkWatcher

4. After running the above command, you need to wait for a few minutes for the registration to complete. You can check the status of the registration by running the following command:

az feature list -o table --query "[?contains(name, 'Microsoft.Network/NetworkWatcher')].{Name:name,State:properties.state}"

5. Once the registration is complete, you can create a Network Watcher in the region of your choice by running the following command:

az network watcher create --location <region>

Note: Replace <region> with the name of the region where you want to create the Network Watcher.

6. Finally, you can verify that Network Watchers are enabled by running the following command:

az network watcher list

This should remediate the misconfiguration of Network Watchers not enabled on Azure using Azure CLI.

Using Python

To remediate the “Network Watchers Not Enabled” misconfiguration in Azure using Python, follow these steps:

1. Import the necessary libraries:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.network import NetworkManagementClient

2. Set up the Azure credentials:

subscription_id = 'your_subscription_id'
credentials = ServicePrincipalCredentials(
    client_id = 'your_client_id',
    secret = 'your_client_secret',
    tenant = 'your_tenant_id'
)

3. Instantiate the NetworkManagementClient:

network_client = NetworkManagementClient(
    credentials,
    subscription_id
)

4. Check if Network Watcher is enabled:

watcher = network_client.network_watchers.get('your_resource_group', 'your_network_watcher_name')
if watcher.provisioning_state != 'Succeeded':
    print("Network Watcher is not enabled.")

5. If Network Watcher is not enabled, enable it:

watcher = network_client.network_watchers.create_or_update(
    'your_resource_group',
    'your_network_watcher_name',
    {
        'location': 'your_location'
    }
)

6. Verify that Network Watcher is now enabled:

if watcher.provisioning_state == 'Succeeded':
    print("Network Watcher is now enabled.")

Note: Replace the placeholders (your_subscription_id, your_client_id, your_client_secret, your_tenant_id, your_resource_group, your_network_watcher_name, and your_location) with the appropriate values for your Azure environment.

Using Terraform

# Enable Network Watcher in a region for your subscription.
# This is a subscription/region-level service; it is NOT configured on a subnet
# (azure-networking-virtualnetwork-subnet) directly.

resource "azurerm_resource_group" "NETWORK_WATCHER_RG" {
  name     = "NETWORK_WATCHER_RESOURCE_GROUP_NAME" # e.g. "NetworkWatcherRG"
  location = "AZURE_REGION"                        # e.g. "eastus"
}

resource "azurerm_network_watcher" "NETWORK_WATCHER" {
  name                = "NETWORK_WATCHER_NAME"          # e.g. "NetworkWatcher_eastus"
  location            = azurerm_resource_group.NETWORK_WATCHER_RG.location
  resource_group_name = azurerm_resource_group.NETWORK_WATCHER_RG.name
}

Substitute:

• AZURE_REGION with the Azure region where your virtual networks/subnets live.
• NETWORK_WATCHER_RESOURCE_GROUP_NAME with the resource group to hold Network Watcher.
• NETWORK_WATCHER_NAME with a unique Network Watcher name for that region (Azure’s convention is NetworkWatcher_<region>).

This change does not force replacement of any existing virtual networks or subnets; it only creates (or manages) the Network Watcher resource.

For verification, terraform plan should show:

• + azurerm_network_watcher.NETWORK_WATCHER to be created (and its resource group if new),
• no changes to your existing azurerm_virtual_network / azurerm_subnet resources.