Overview
A network security group (NSG) includes rules that allow or deny traffic to a virtual network subnet, network interface, or both.
When you enable logging for an NSG, you can gather the following types of resource log:
Event log: Entries are logged for which NSG rules are applied to virtual machines, based on MAC address.
Rule counter log: Contains entries for how many times each NSG rule is applied to allow or deny traffic.
| Info |
|---|
Note: Resource logging is enabled separately for each NSG for which to collect the diagnostic data. |
| Anchor | ||||
|---|---|---|---|---|
|
The event log contains information about which NSG rules are applied to virtual machines, based on MAC address and the following information is logged for each event.
Log Structure
| Expand | ||
|---|---|---|
| ||
{ |
Table Fields
Field | Description |
|---|---|
TABLE | AzureNetworkSecurityGroupEvent is a value derived from Azure + CATEGORY’s value. |
SYSTEM | Will base its value on PRIMARYIPV4ADDRESS if not empty; otherwise, it will use the domain value defined in the configuration. |
DATE | Based on the extracted date value from CreatedDateTime. |
TIME | Based on the extracted time value from CreatedDateTime. |
DATETIME | Based on the extracted datetime value from CreatedDateTime and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
COLLECTIONDATETIME | Snare Central’s local date and time of the log collection from the API, formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
ADDITIONALFIELDS | Based on AdditionalFields, this field contains the data is added to a dynamic property bag column. |
ACTIONTYPE | Based on type_s, this field indicates the action done, either allow or deny, as specified in the rule. |
CATEGORY | Based on Category, this field indicates the log category of the event, NetworkSecurityGroupEvent is the fix value for this log type. |
CONDITIONSDESTINATIONIP | Based on conditions_destinationIP_s, this field indicates the value of destination IP addresses ranges, as specified in the rule. |
CONDITIONSDESTINATIONPORTRANGE | Based on conditions_destinationPortRange_s, this field indicates the value of destination port ranges, as specified in the rule. |
CONDITIONSSOURCEIP | Based on conditions_sourceIP_s, this field indicates the value of source IP addresses/CIDR ranges, as specified in the rule. |
CONDITIONSSOURCEPORTRANGE | Based on conditions_sourcePortRange_s, this field indicates the value of source port ranges, as specified in the rule. |
CONDITIONSPROTOCOLS | Based on conditions_protocols_s, this field indicates the value of protocol, as specified in the rule. |
DIRECTION | Based on direction_s, this field indicates the request direction either In or Out, as specified in the rule. |
INGESTIONTIME | Based on IngestionTime, this field indicates the datetime value specifying the approximate time of ingestion into an Azure table. |
LOGID | Based on LogId, this field indicates a unique identifier for the record or log. |
MACADDRESS | Based on macAddress_s, this field indicates the MAC address of the VM associated with the NSG resource. |
OPERATIONNAME | Based on OperationName, this field indicates the name of the operation that this event represents, NetworkSecurityGroupEvents is the fix value for this log type. |
PRIMARYIPV4ADDRESS | Based on primaryIPv4Address_s, this field indicates the private IP address of the VM associated with the NSG resource. |
PRIORITY | Based on priority_d, this field indicates the priority of the rule set and configured on the NSG resource. |
RESOURCE | Based on Resource, this field indicates the name of the impacted resource. |
RESOURCEGROUP | Based on ResourceGroup, this field indicates the resource group name of the impacted resource. |
RESOURCEID | Based on ResourceId, this field indicates a unique identifier for the resource that the record or log is associated with. |
RESOURCEPROVIDER | Based on ResourceProvider, this field indicates the Id of the resource provider for the impacted resource, MICROSOFT.NETWORK is the fix value for this log type. |
RESOURCETYPE | Based on ResourceType, this field indicates the type of the impacted resource, NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs. |
RULENAME | Based on ruleName_s, this field indicates the rule name set and configured on the NSG resource. |
SOURCESYSTEM | Based on SourceSystem, this field contains Azure as fix value for all log types under AzureDiagnostics table. |
SUBNETPREFIX | Based on subnetPrefix_s, this field indicates the subnet of the VM associated with the NSG resource. |
SUBSCRIPTIONID | Based on SubscriptionId, this field indicates the subscription ID of the impacted resource. |
SYSTEMID | Based on systemId_g, this field indicates the system ID of the network security group. |
TENANTID | Based on TenantId, this field indicates the Log Analytics workspace ID. |
TIMEGENERATED | Based on TimeGenerated, this field indicates the timestamp when the event was generated by the Azure service processing the request corresponding the event. |
TYPE | Based on Type, this field indicates the name of the table, AzureDiagnostics is the fix value for this log type. |
VNETRESOURCEGUID | Based on vnetResourceGuid_g, this field indicates the virtual network ID of the VM associated with the NSG resource. |
WORKSPACEID | A value that was derived from TenantId. |
SNAREDATAMAP | All unclassified field(s) parsed from this log type will be pushed into the SNAREDATAMAP in key=value format and separated by newline. |
| Anchor | ||||
|---|---|---|---|---|
|
The rule counter log contains information about each rule applied to resources.
The status for these rules is collected every 300 seconds.
Log Structure
| Expand | ||
|---|---|---|
| ||
{ |
Table Fields
Field | Description |
|---|---|
TABLE | AzureNetworkSecurityGroupCounters is a value derived from Azure + CATEGORY’s value. |
SYSTEM | Will base its value on PRIMARYIPV4ADDRESS if not empty; otherwise, it will use the domain value defined in the configuration. |
DATE | Based on the extracted date value from CreatedDateTime. |
TIME | Based on the extracted time value from CreatedDateTime. |
DATETIME | Based on the extracted datetime value from CreatedDateTime and formatted usingRFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
COLLECTIONDATETIME | Snare Central’s local date and time of the log collection from the API, formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format. |
ADDITIONALFIELDS | Based on AdditionalFields, this field contains the data is added to a dynamic property bag column. |
ACTIONTYPE | Based on type_s, this field indicates the action done, either allow or deny, as specified in the rule. |
CATEGORY | Based on Category, this field indicates the log category of the event, NetworkSecurityGroupRuleCounter is the fix value for this log type. |
DIRECTION | Based on direction_s, this field indicates the request direction either In or Out, as specified in the rule. |
INGESTIONTIME | Based on IngestionTime, this field indicates the datetime value specifying the approximate time of ingestion into an Azure table. |
LOGID | Based on LogId, this field indicates a unique identifier for the record or log. |
MACADDRESS | Based on macAddress_s, this field indicates the MAC address of the VM associated with the NSG resource. |
MATCHEDCONNECTIONS | Based on matchedConnections_d, there’s no available documentation for this field. |
OPERATIONNAME | Based on OperationName, this field indicates the name of the operation that this event represents, NetworkSecurityGroupCounters is the fix value for this log type. |
PRIMARYIPV4ADDRESS | Based on primaryIPv4Address_s, this field indicates the private IP address of the VM associated with the NSG resource. |
RESOURCE | Based on Resource, this field indicates the name of the impacted resource. |
RESOURCEGROUP | Based on ResourceGroup, this field indicates the resource group name of the impacted resource. |
RESOURCEID | Based on ResourceId, this field indicates a unique identifier for the resource that the record or log is associated with. |
RESOURCEPROVIDER | Based on ResourceProvider, this field indicates the Id of the resource provider for the impacted resource, MICROSOFT.NETWORK is the fix value for this log type. |
RESOURCETYPE | Based on ResourceType, this field indicates the type of the impacted resource, NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs. |
RULENAME | Based on ruleName_s, this field indicates the rule name set and configured on the NSG resource. |
SOURCESYSTEM | Based on SourceSystem, this field contains Azure as fix value for all log types under AzureDiagnostics table. |
SUBNETPREFIX | Based on subnetPrefix_s, this field indicates the subnet of the VM associated with the NSG resource. |
SUBSCRIPTIONID | Based on SubscriptionId, this field indicates the subscription ID of the impacted resource. |
SYSTEMID | Based on systemId_g, this field indicates the system ID of the network security group. |
TENANTID | Based on TenantId, this field indicates the Log Analytics workspace ID. |
TIMEGENERATED | Based on TimeGenerated, this field indicates the timestamp when the event was generated by the Azure service processing the request corresponding the event. |
TYPE | Based on Type, this field indicates the name of the table, AzureDiagnostics is the fix value for this log type. |
VNETRESOURCEGUID | Based on vnetResourceGuid_g, this field indicates the virtual network ID of the VM associated with the NSG resource. |
WORKSPACEID | A value that was derived from TenantId. |
SNAREDATAMAP | All unclassified field(s) parsed from this log type will be pushed into the SNAREDATAMAP in key=value format and separated by newline. |
Notes
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azurediagnostics