Overview
A network security group (NSG) includes rules that allow or deny traffic to a virtual network subnet, network interface, or both.
When you enable logging for an NSG, you can gather the following types of resource log information:
Event: Entries are logged for which NSG rules are applied to virtual machines, based on MAC address.
Rule counter: Contains entries for how many times each NSG rule is applied to allow or deny traffic. The status for these rules is collected every 300 seconds.
Resource logging is enabled separately for each NSG for which to collect diagnostic data.
Azure NSG Group Event: AzureNetworkSecurityGroupEvent
The event log contains information about which NSG rules are applied to virtual machines, based on MAC address. The following data is logged for each event.
Log Structure
| Expand | ||
|---|---|---|
| ||
{ |
Table Fields
Field | Description |
|---|---|
TABLE | AzureActivity AzureNetworkSecurityGroupEvent was a value derived from TYPE + OPERATIONNAME. |
SYSTEM | Depends on CALLERIPADDRESS PRIMARYIPV4ADDRESS field if not empty, else will depend on configured domain value. |
DATE | Extracted date value from CREATEDDATETIME. |
TIME | Extracted time value from CREATEDDATETIME. |
DATETIME | Extracted datetime value from CREATEDDATETIME and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
COLLECTIONDATETIME | The datetime value when the log was collected from the API and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
ADDITIONALFIELDS | If the total number of columns is at or above 500, the excess data is added to a dynamic property bag column called AdditionalFields as a property. |
ACTIONTYPE | Action done, either allow or deny, as specified in the rule. |
CATEGORY | NetworkSecurityGroupEvent is the fix value for this log type. |
CONDITIONSDESTINATIONIP | The value of Destination IP addresses ranges, as specified in the rule. |
CONDITIONSDESTINATIONPORTRANGE | The value of Destination port ranges, as specified in the rule. |
CONDITIONSSOURCEIP | The value of Source IP addresses/CIDR ranges, as specified in the rule. |
CONDITIONSSOURCEPORTRANGE | The value of Source port ranges, as specified in the rule. |
CONDITIONSPROTOCOLS | The value of Protocol, as specified in the rule. |
DIRECTION | Possible values: In or Out, as specified in the rule. |
INGESTIONTIME | A datetime value specifying the approximate time of ingestion into an Azure table. |
LOGID | A unique identifier for the record or log. |
MACADDRESS | MAC address of the VM associated with the NSG resource. |
OPERATIONNAME | NetworkSecurityGroupEvents is the fix value for this log type. |
PRIMARYIPV4ADDRESS | Private IP address of the VM associated with the NSG resource. |
PRIORITY | Priority of the rule set and configured on the NSG resource. |
RESOURCE | If empty, will use the value from Properties.resource as its value. |
RESOURCEGROUP | Resource group name of the impacted resource. |
RESOURCEID | A unique identifier for the resource that the record or log is associated with. |
RESOURCEPROVIDER | Id of the resource provider for the impacted resource, for this log type it will be MICROSOFT.NETWORK |
RESOURCETYPE | NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs. |
RULENAME | Rule name set and configured on the NSG resource. |
SOURCESYSTEM | Azure is the fix value for all log types under AzureDiagnostics table. |
SUBNETPREFIX | Subnet of the VM associated with the NSG resource. |
SUBSCRIPTIONID | Subscription ID of the impacted resource. |
SYSTEMID | System ID of the network security group. |
TENANTID | The Log Analytics workspace ID. |
TIMEGENERATED | Timestamp when the event was generated by the Azure service processing the request corresponding the event. |
TYPE | AzureDiagnostics is the fix value for this log type. |
VNETRESOURCEGUID | Virtual network ID of the VM associated with the NSG resource. |
WORKSPACEID | Derived from TenantId if not empty, else will depend configured value for the Workspace ID. |
SNAREDATAMAP | All unclassified field/s in the log will be pushed into the SNAREDATAMAP using key=value format and separated by newline. |
Azure NSG Group Rule Counter: AzureNetworkSecurityGroupRuleCounter
The rule counter log contains information about each rule applied to resources. The following example data is logged each time a rule is applied.
Log Structure
| Expand | ||
|---|---|---|
| ||
{ |
Table Fields
Field | Description |
|---|---|
TABLE | AzureActivity AzureNetworkSecurityGroupCounters was a value derived from TYPE + OPERATIONNAME. |
SYSTEM | Depends on CALLERIPADDRESS PRIMARYIPV4ADDRESS field if not empty, else will depend on configured domain value. |
DATE | Extracted date value from CREATEDDATETIME. |
TIME | Extracted time value from CREATEDDATETIME. |
DATETIME | Extracted datetime value from CREATEDDATETIME and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
COLLECTIONDATETIME | The datetime value when the log was collected from the API and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
ADDITIONALFIELDS | If the total number of columns is at or above 500, the excess data is added to a dynamic property bag column called AdditionalFields as a property. |
ACTIONTYPE | Action done, either allow or deny, as specified in the rule. |
CATEGORY | NetworkSecurityGroupRuleCounter is the fix value for this log type. |
DIRECTION | Possible values: In or Out, as specified in the rule. |
INGESTIONTIME | A datetime value specifying the approximate time of ingestion into an Azure table. |
LOGID | A unique identifier for the record or log. |
MACADDRESS | MAC address of the VM associated with the NSG resource. |
MATCHEDCONNECTIONS | No description in the external documentation. |
OPERATIONNAME | NetworkSecurityGroupCounters is the fix value for this log type. |
PRIMARYIPV4ADDRESS | Private IP address of the VM associated with the NSG resource. |
RESOURCE | If empty, will use the value from Properties.resource as its value. |
RESOURCEGROUP | Resource group name of the impacted resource. |
RESOURCEID | A unique identifier for the resource that the record or log is associated with. |
RESOURCEPROVIDER | Id of the resource provider for the impacted resource, for this log type it will be MICROSOFT.NETWORK |
RESOURCETYPE | NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs. |
RULENAME | Rule name set and configured on the NSG resource. |
SOURCESYSTEM | Azure is the fix value for all log types under AzureDiagnostics table. |
SUBNETPREFIX | Subnet of the VM associated with the NSG resource. |
SUBSCRIPTIONID | Subscription ID of the impacted resource. |
SYSTEMID | System ID of the network security group. |
TENANTID | The Log Analytics workspace ID. |
TIMEGENERATED | Timestamp when the event was generated by the Azure service processing the request corresponding the event. |
TYPE | AzureDiagnostics is the fix value for this log type. |
VNETRESOURCEGUID | Virtual network ID of the VM associated with the NSG resource. |
WORKSPACEID | Derived from TenantId if not empty, else will depend configured value for the Workspace ID. |
SNAREDATAMAP | All unclassified field/s in the log will be pushed into the SNAREDATAMAP using key=value format and separated by newline. |
Notes
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azurediagnostics