Azure Resource logs: NSG logs

TABLE

AzureNetworkSecurityGroupEvent was a value derived from TYPE + OPERATIONNAME.

SYSTEM

Depends on PRIMARYIPV4ADDRESS field if not empty, else will depend on configured domain value.

DATE

Extracted date value from CREATEDDATETIME.

TIME

Extracted time value from CREATEDDATETIME.

DATETIME

Extracted datetime value from CREATEDDATETIME and formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format.

COLLECTIONDATETIME

The datetime value when the log was collected from the API and formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format.

ADDITIONALFIELDS

If the total number of columns is at or above 500, the excess data is added to a dynamic property bag column called AdditionalFields as a property.

ACTIONTYPE

Action done, either allow or deny, as specified in the rule.

CATEGORY

NetworkSecurityGroupEvent is the fix value for this log type.

CONDITIONSDESTINATIONIP

The value of Destination IP addresses ranges, as specified in the rule.

CONDITIONSDESTINATIONPORTRANGE

The value of Destination port ranges, as specified in the rule.

CONDITIONSSOURCEIP

The value of Source IP addresses/CIDR ranges, as specified in the rule.

CONDITIONSSOURCEPORTRANGE

The value of Source port ranges, as specified in the rule.

CONDITIONSPROTOCOLS

The value of Protocol, as specified in the rule.

DIRECTION

Possible values: In or Out, as specified in the rule.

INGESTIONTIME

A datetime value specifying the approximate time of ingestion into an Azure table.

LOGID

A unique identifier for the record or log.

MACADDRESS

MAC address of the VM associated with the NSG resource.

OPERATIONNAME

NetworkSecurityGroupEvents is the fix value for this log type.

PRIMARYIPV4ADDRESS

Private IP address of the VM associated with the NSG resource.

PRIORITY

Priority of the rule set and configured on the NSG resource.

RESOURCE

If empty, will use the value from Properties.resource as its value.

RESOURCEGROUP

Resource group name of the impacted resource.

RESOURCEID

A unique identifier for the resource that the record or log is associated with.

RESOURCEPROVIDER

Id of the resource provider for the impacted resource, for this log type it will be MICROSOFT.NETWORK

RESOURCETYPE

NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs.

RULENAME

Rule name set and configured on the NSG resource.

SOURCESYSTEM

Azure is the fix value for all log types under AzureDiagnostics table.

SUBNETPREFIX

Subnet of the VM associated with the NSG resource.

SUBSCRIPTIONID

Subscription ID of the impacted resource.

SYSTEMID

System ID of the network security group.

TENANTID

The Log Analytics workspace ID.

TIMEGENERATED

Timestamp when the event was generated by the Azure service processing the request corresponding the event.

TYPE

AzureDiagnostics is the fix value for this log type.

VNETRESOURCEGUID

Virtual network ID of the VM associated with the NSG resource.

WORKSPACEID

Derived from TenantId if not empty, else will depend configured value for the Workspace ID.

SNAREDATAMAP

All unclassified field/s in the log will be pushed into the SNAREDATAMAP using key=value format and separated by newline.

TABLE

AzureNetworkSecurityGroupCounters was a value derived from TYPE + OPERATIONNAME.

SYSTEM

Depends on PRIMARYIPV4ADDRESS field if not empty, else will depend on configured domain value.

DATE

Extracted date value from CREATEDDATETIME.

TIME

Extracted time value from CREATEDDATETIME.

DATETIME

Extracted datetime value from CREATEDDATETIME and formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format.

COLLECTIONDATETIME

The datetime value when the log was collected from the API and formatted using RFC3339Nano (2023-03-03T01:59:16.756103200Z00:00) format.

ADDITIONALFIELDS

If the total number of columns is at or above 500, the excess data is added to a dynamic property bag column called AdditionalFields as a property.

ACTIONTYPE

Action done, either allow or deny, as specified in the rule.

CATEGORY

NetworkSecurityGroupRuleCounter is the fix value for this log type.

DIRECTION

Possible values: In or Out, as specified in the rule.

INGESTIONTIME

A datetime value specifying the approximate time of ingestion into an Azure table.

LOGID

A unique identifier for the record or log.

MACADDRESS

MAC address of the VM associated with the NSG resource.

MATCHEDCONNECTIONS

No description in the external documentation.

OPERATIONNAME

NetworkSecurityGroupCounters is the fix value for this log type.

PRIMARYIPV4ADDRESS

Private IP address of the VM associated with the NSG resource.

RESOURCE

If empty, will use the value from Properties.resource as its value.

RESOURCEGROUP

Resource group name of the impacted resource.

RESOURCEID

A unique identifier for the resource that the record or log is associated with.

RESOURCEPROVIDER

Id of the resource provider for the impacted resource, for this log type it will be MICROSOFT.NETWORK

RESOURCETYPE

NETWORKSECURITYGROUPS is the fix value for all Azure NSG logs.

RULENAME

Rule name set and configured on the NSG resource.

SOURCESYSTEM

Azure is the fix value for all log types under AzureDiagnostics table.

SUBNETPREFIX

Subnet of the VM associated with the NSG resource.

SUBSCRIPTIONID

Subscription ID of the impacted resource.

SYSTEMID

System ID of the network security group.

TENANTID

The Log Analytics workspace ID.

TIMEGENERATED

Timestamp when the event was generated by the Azure service processing the request corresponding the event.

TYPE

AzureDiagnostics is the fix value for this log type.

VNETRESOURCEGUID

Virtual network ID of the VM associated with the NSG resource.

WORKSPACEID

Derived from TenantId if not empty, else will depend configured value for the Workspace ID.

SNAREDATAMAP

All unclassified field/s in the log will be pushed into the SNAREDATAMAP using key=value format and separated by newline.