Log Analytics workspace retention should be at least 90 days

Medium Azure General loganalytics-log-analytics-workspace-retention

Adequate log retention is necessary for security investigation and compliance

Applies to

Microsoft.OperationalInsights/workspaces

What CGPulse checks

A resource passes this rule when retentionInDays must be greater than 89. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set data retention to at least 90 days for adequate security incident investigation. In Azure Portal: Log Analytics workspace > Usage and estimated costs > set Data Retention to 90+ days. See: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure

CLI

az monitor log-analytics workspace update --ids "{id}" --retention-time 90

Terraform

resource "azurerm_log_analytics_workspace" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

Compliance frameworks

Cloud Security BaselineLT-6

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan