> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Watchers Not Provisioned

### More Info:

Ensure that Network Watcher service is enabled and Network Watchers are provisioned within your Azure account subscriptions to help you monitor and diagnose various conditions at the network level. Microsoft Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources within a virtual network.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* GDPR
* HIPAA
* ISO 27001
* NIST CSF
* PCI
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Network Watchers Not Provisioned" in Azure using the Azure console, please follow the below steps:

        1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Select the subscription where the issue is occurring.
        3. Navigate to the "Network Watcher" service.
        4. Select the "Network Watchers" option from the left-hand menu.
        5. Click on the "Add" button to create a new Network Watcher.
        6. In the "Basics" tab, provide a name for the Network Watcher and select the region where you want to deploy it.
        7. In the "Review + create" tab, review the settings, and click on the "Create" button to create the Network Watcher.
        8. Once the Network Watcher is created, navigate to the "Virtual Network" service.
        9. Select the virtual network where you want to enable Network Watcher.
        10. Click on the "Network Watcher" option from the left-hand menu.
        11. Select the "Configure" option and enable the Network Watcher.
        12. Once the Network Watcher is enabled, you can use it to monitor and diagnose your virtual network.

        By following the above steps, you can remediate the misconfiguration of "Network Watchers Not Provisioned" in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Network Watchers Not Provisioned" misconfiguration in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI on your local machine or in the Azure portal.

        2. Login to your Azure account using the command:

           ```
           az login
           ```

        3. Check if the Network Watcher is already provisioned in your Azure subscription using the command:

           ```
           az network watcher list
           ```

        4. If the Network Watcher is not provisioned, create a new Network Watcher using the command:

           ```
           az network watcher create --name <network-watcher-name> --location <location>
           ```

           Replace `<network-watcher-name>` with a unique name for the Network Watcher and `<location>` with the location where you want to create the Network Watcher.

        5. Once the Network Watcher is provisioned, you can enable it for a specific virtual network using the command:

           ```
           az network watcher configure --locations <location> --enabled true --resource-group <resource-group-name> --name <network-watcher-name>
           ```

           Replace `<location>` with the location where the virtual network is located, `<resource-group-name>` with the name of the resource group containing the virtual network, and `<network-watcher-name>` with the name of the Network Watcher you created in step 4.

        6. Verify that the Network Watcher is now provisioned and enabled using the command:

           ```
           az network watcher show --name <network-watcher-name> --resource-group <resource-group-name>
           ```

           Replace `<network-watcher-name>` with the name of the Network Watcher you created and `<resource-group-name>` with the name of the resource group containing the Network Watcher.

        7. Repeat steps 5 and 6 for each virtual network that you want to enable Network Watcher on.

        Once you have completed these steps, you should have remediated the "Network Watchers Not Provisioned" misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Network Watchers Not Provisioned" in Azure using Python, follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.network import NetworkManagementClient
        ```

        2. Authenticate with Azure using a Service Principal:

        ```python theme={null}
        TENANT_ID = '<your-tenant-id>'
        CLIENT_ID = '<your-client-id>'
        CLIENT_SECRET = '<your-client-secret>'
        SUBSCRIPTION_ID = '<your-subscription-id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )
        ```

        3. Create a Network Management client object:

        ```python theme={null}
        network_client = NetworkManagementClient(
            credentials=credentials,
            subscription_id=SUBSCRIPTION_ID
        )
        ```

        4. Check if Network Watchers are provisioned:

        ```python theme={null}
        watchers = list(network_client.network_watchers.list())

        if len(watchers) == 0:
            print("No Network Watchers are provisioned in the subscription")
        else:
            print("Network Watchers are provisioned in the subscription")
        ```

        5. If Network Watchers are not provisioned, create a new Network Watcher:

        ```python theme={null}
        WATCHER_RG_NAME = '<your-watcher-resource-group-name>'
        WATCHER_NAME = '<your-watcher-name>'
        WATCHER_LOCATION = '<your-watcher-location>'

        watcher_params = {
            'location': WATCHER_LOCATION
        }

        watcher = network_client.network_watchers.create_or_update(
            resource_group_name=WATCHER_RG_NAME,
            network_watcher_name=WATCHER_NAME,
            parameters=watcher_params
        )

        print("Network Watcher created with name '{}'".format(watcher.name))
        ```

        6. Verify that Network Watchers are now provisioned:

        ```python theme={null}
        watchers = list(network_client.network_watchers.list())

        if len(watchers) == 0:
            print("No Network Watchers are provisioned in the subscription")
        else:
            print("Network Watchers are provisioned in the subscription")
        ```

        Once you have completed these steps, the "Network Watchers Not Provisioned" misconfiguration should be remediated in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Network Watcher must be provisioned at the *subscription/region* level,
        # not on the subnet resource itself. Attach it to the same region and
        # resource group that hosts your virtual network.

        resource "azurerm_resource_group" "network_watcher_rg" {
          name     = "NETWORK_WATCHER_RESOURCE_GROUP_NAME" # e.g. "rg-network-watcher-centralus"
          location = "AZURE_REGION"                        # e.g. "centralus"
        }

        resource "azurerm_network_watcher" "network_watcher" {
          name                = "NETWORK_WATCHER_NAME"      # e.g. "NetworkWatcher_centralus"
          location            = azurerm_resource_group.network_watcher_rg.location
          resource_group_name = azurerm_resource_group.network_watcher_rg.name
        }

        # Example of your existing subnet; no change required on this resource itself
        resource "azurerm_virtual_network" "example_vnet" {
          name                = "VNET_NAME"
          location            = "AZURE_REGION"              # must match the region of the watcher
          resource_group_name = "VNET_RESOURCE_GROUP_NAME"
          address_space       = ["10.0.0.0/16"]
        }

        resource "azurerm_subnet" "example_subnet" {
          name                 = "SUBNET_NAME"
          resource_group_name  = azurerm_virtual_network.example_vnet.resource_group_name
          virtual_network_name = azurerm_virtual_network.example_vnet.name
          address_prefixes     = ["10.0.1.0/24"]
        }
        ```

        This change does not force replacement of existing virtual networks or subnets; it only adds a new `azurerm_network_watcher` resource.

        To verify, `terraform plan` should show one new resource to add (`azurerm_network_watcher.network_watcher`, plus the resource group if new) and no changes to existing subnets or VNets.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>