Get details about NGS rule listed more than 90 days

Himanshuk 161 Reputation points
2022-03-25T15:21:18.313+00:00

I got alert about vulnerability check about NSG rule but that was created 90 days ago and not listed in logs or monitoring kql query, how to get NSG rules from created and active from past 1 year or more and who consume it using powershell or az cli or kql

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,935 questions
Azure Network Watcher
Azure Network Watcher
An Azure service that is used to monitor, diagnose, and gain insights into network performance and health.
159 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,171 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Shashi Shailaj 7,581 Reputation points Microsoft Employee
    2022-04-09T17:32:25.637+00:00

    anonymous user

    Thank you for your patience with us on this thread. We tested this and would like to share our findings.

    You required information on changes made to NSG rule and information about who updated/created a network security group. The data for any activity on azure ARM resources is stored in the Activity Log . This can be done by querying the platform logs within a log analytics workspace. Platform logs provide detailed diagnostic and auditing information for Azure resources . The data that we would require for this scenario would be present in the AzureActivity logs within a table with same name. For this, the data will first need to be ingested to a log analytics workspace and then analyzed.

    Azure Activity logs are retained for 90 days and then they are deleted from the backend. In order to collect data older than 90 days , you would have to create a separate log analytics workspace and ingest the Activity Logs . For the first 90 days it wont be charged and after that the logs will be charged as per the standard azure monitor pricing .

    As mentioned earlier , the Log Analytics workspace needs to be configured to collect All AzureActivity logs to the Log Analytics Workspace for the subscriptions that you would like to monitor. I tested this in my lab in a step-by-step fashion as mentioned below by enabling diagnostics settings on the subscription .

    • Open Azure Portal .
    • Go to the Azure subscription where your users would be creating the Network security groups.
    • Create a new Log analytics workspace in your subscription .
    • Click on Subscription > [Your Subscription Name ] > Activity Log > Export Activity Log option.
    • 191533-image.png
    • If you have multiple subscriptions you may have to repeat this for every subscription . But all these subscriptions need to be associated with the same Azure Ad instance . For cross workspace queries please see this article.
    • Once you click the Export Activity Log , It will show the diagnostic settings that need to be configured in order for the log analytics workspace to receive platform logs which we need in our case.
    • 191535-image.png
    • Click on **Add diagnostic Settings ** to add a diagnostic setting which is like subscribing to the platform logs so that the logs that get generated for this azure subscription also get copied you your log analytics workspace which you have created .
    • There are multiple different types of logs created on Azure which you could export to the log analytics workspace.
    • In this case only choosing Administrative logs should work for us. Since ingestion of all the data would increase the cost as well .
    • 191502-image.png
    • Once this is setup , the logs started appearing in 10 mins in the log analytics workspace in my subscription .
    • The data retention for log analytics is a maximum for 2 years as shown below. You can further export the data to a storage account for long term storage.
    • 191545-image.png
    • You can use the following Kusto query to query the log analytics workspace . this query will search for Network Security group create and modify operations specifically . AzureActivity
      | where OperationNameValue contains "Microsoft.Network/networkSecurityGroups"
      | where Properties_d.message == "Microsoft.Network/networkSecurityGroups/securityRules/write"
      | project TimeGenerated, OperationNameValue , Caller , ResourceGroup , SubscriptionId , HTTPRequest , Properties , _ResourceId , Type
      | order by TimeGenerated asc
    • The following is how the result would look .
    • 191493-image.png
    • In case you are looking for exact rule change you would have to expand and check each of the properties for the securityrules/write operations and find details in the request body .
    • If you check the event and expand the event > Properties > requestbody you can find the change .
    • 191504-image.png
    • Here you can see who the caller for this event is and what rules were updated.

    This will not show any old logs and only ingest the logs from the day you enable this . And it can be enabled for a maximum of 2 years. However you should consider the cost for this before going ahead with this. Exporting and storing these logs to a Azure storage account would be more cost effective however in that case you would have to download it you may not get the flexibility of KQL query from the portal's UI interface. You can enable the diagnostic settings for the sending logs to storage account and export it to similar to what is shown in this article. I would strongly suggest to understand how logs are stored in the storage account by reading this doc . You can download these logs using Storage explorer whenever its required to audit them. This can save overall cost of auditing NSGs in your scenario.

    Hope this helps answer your query . I have included multiple links from our documentation and I would suggest you to go through them as they will help you understand more on the options for logs storage . In case the information provided is helpful , please do accept the post as answer in order to improve the relevancy of this answer for the community and other readers. In case you have any other query on this feel free to let us know and we will be happy to help you further.

    Thank you .

    ----------------------------------------------------------------------------------------------------------------------------------------------------------

    • Please don't forget to click on 130616-image.png whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
    • Want a reminder to come back and check responses? Here is how to subscribe to a notification
    • If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators
    1 person found this answer helpful.
    0 comments No comments

  2. Sudipta Chakraborty - MSFT 1,101 Reputation points Microsoft Employee
    2022-03-25T18:15:12.617+00:00

    anonymous user :

    You can use the below mentioned powershell script to get all the NSG rules in your subscription and export it to a CSV file.

    Connect-AzAccount  
      
    $azSubs = Get-AzSubscription -SubscriptionId 'xxxxx-9573-xxxx-886f-YourSubscriptionId'  
      
    foreach ( $azSub in $azSubs ) {  
        Set-AzContext -Subscription $azSub | Out-Null  
        $azSubName = $azSub.Name  
      
        $azNsgs = Get-AzNetworkSecurityGroup   
          
        foreach ( $azNsg in $azNsgs ) {  
      
            # Export custom rules from NSGs in your subscription  
            Get-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $azNsg | `  
                Select-Object @{label = 'NSG Name'; expression = { $azNsg.Name } }, `  
                @{label = 'NSG Location'; expression = { $azNsg.Location } }, `  
                @{label = 'Rule Name'; expression = { $_.Name } }, `  
                @{label = 'Source'; expression = { $_.SourceAddressPrefix } }, `  
                @{label = 'Source Application Security Group'; expression = { $_.SourceApplicationSecurityGroups.id.Split('/')[-1] } },  
                @{label = 'Source Port Range'; expression = { $_.SourcePortRange } }, Access, Priority, Direction, `  
                @{label = 'Destination'; expression = { $_.DestinationAddressPrefix } }, `  
                @{label = 'Destination Application Security Group'; expression = { $_.DestinationApplicationSecurityGroups.id.Split('/')[-1] } }, `  
                @{label = 'Destination Port Range'; expression = { $_.DestinationPortRange } }, `  
                @{label = 'Resource Group Name'; expression = { $azNsg.ResourceGroupName } } | `  
                Export-Csv -Path ".\$azSubName-nsg-rules.csv" -NoTypeInformation -Append -force  
              
            # Export default rules from NSGs in your subscription  
            Get-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $azNsg -Defaultrules | `  
                Select-Object @{label = 'NSG Name'; expression = { $azNsg.Name } }, `  
                @{label = 'NSG Location'; expression = { $azNsg.Location } }, `  
                @{label = 'Rule Name'; expression = { $_.Name } }, `  
                @{label = 'Source'; expression = { $_.SourceAddressPrefix } }, `  
                @{label = 'Source Port Range'; expression = { $_.SourcePortRange } }, Access, Priority, Direction, `  
                @{label = 'Destination'; expression = { $_.DestinationAddressPrefix } }, `  
                @{label = 'Destination Port Range'; expression = { $_.DestinationPortRange } }, `  
                @{label = 'Resource Group Name'; expression = { $azNsg.ResourceGroupName } } | `  
                Export-Csv -Path ".\$azSubName-nsg-rules.csv" -NoTypeInformation -Append -force  
            
        }      
    }  
    
    0 comments No comments

  3. Rahul Dhande 20 Reputation points
    2023-04-27T16:02:32.6066667+00:00

    Hi @Shashi Shailaj How the KQL Query to match NSG Inbound Rules with other Resource Group NSG Inbound Rules. If not match then fire alert

    Regards,

    Rahul

    0 comments No comments