Adaptive Network Hardenings - Enforce

Referencia

Service:: Defender for Cloud

API Version:: 2020-01-01

A megadott szabályok kényszerítése a kérelemben felsorolt NSG(k)en

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceNamespace}/{resourceType}/{resourceName}/providers/Microsoft.Security/adaptiveNetworkHardenings/{adaptiveNetworkHardeningResourceName}/enforce?api-version=2020-01-01

URI-paraméterek

Name	In	Kötelező	Típus	Description
adaptiveNetworkHardeningEnforceAction	path	True	AdaptiveNetworkHardeningEnforceAction	A megadott szabályok kényszerítése a kérelemben felsorolt NSG(k)en
adaptiveNetworkHardeningResourceName	path	True	string	Az adaptív hálózatmegerősítési erőforrás neve.
resourceGroupName	path	True	string	A felhasználó előfizetésében található erőforráscsoport neve. A név megkülönbözteti a kis- és nagybetűket. Regex pattern: `^[-\w\._]+$`
resourceName	path	True	string	Az erőforrás neve.
resourceNamespace	path	True	string	Az erőforrás névtere.
resourceType	path	True	string	Az erőforrás típusa.
subscriptionId	path	True	string	Azure-előfizetés azonosítója Regex pattern: `^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$`
api-version	query	True	string	A művelet API-verziója

Kérelem törzse

Name	Kötelező	Típus	Description
networkSecurityGroups	True	string[]	A hatályos hálózati biztonsági csoportok Azure-erőforrás-azonosítói, amelyek frissülnek az Adaptív hálózatmegerősítési szabályokból létrehozott biztonsági szabályokkal
rules	True	Rule[]	A kényszerítendő szabályok

Válaszok

Name	Típus	Description
200 OK		OK gombra.
202 Accepted		Elfogadva
Other Status Codes	CloudError	Hibaválasz, amely leírja, hogy a művelet miért hiúsult meg.

Biztonság

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	felhasználói fiók megszemélyesítése

Példák

Enforces the given rules on the NSG(s) listed in the request

Sample Request

POST https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.Security/adaptiveNetworkHardenings/default/enforce?api-version=2020-01-01

{
  "rules": [
    {
      "name": "rule1",
      "direction": "Inbound",
      "destinationPort": 3389,
      "protocols": [
        "TCP"
      ],
      "ipAddresses": [
        "100.10.1.1",
        "200.20.2.2",
        "81.199.3.0/24"
      ]
    },
    {
      "name": "rule2",
      "direction": "Inbound",
      "destinationPort": 22,
      "protocols": [
        "TCP"
      ],
      "ipAddresses": []
    }
  ],
  "networkSecurityGroups": [
    "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/nsg1",
    "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg2/providers/Microsoft.Network/networkSecurityGroups/nsg2"
  ]
}

import com.azure.resourcemanager.security.models.AdaptiveNetworkHardeningEnforceRequest;
import com.azure.resourcemanager.security.models.Direction;
import com.azure.resourcemanager.security.models.Rule;
import com.azure.resourcemanager.security.models.TransportProtocol;
import java.util.Arrays;

/** Samples for AdaptiveNetworkHardenings Enforce. */
public final class Main {
    /*
     * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/AdaptiveNetworkHardenings/EnforceAdaptiveNetworkHardeningRules_example.json
     */
    /**
     * Sample code: Enforces the given rules on the NSG(s) listed in the request.
     *
     * @param manager Entry point to SecurityManager.
     */
    public static void enforcesTheGivenRulesOnTheNSGSListedInTheRequest(
        com.azure.resourcemanager.security.SecurityManager manager) {
        manager
            .adaptiveNetworkHardenings()
            .enforce(
                "rg1",
                "Microsoft.Compute",
                "virtualMachines",
                "vm1",
                "default",
                new AdaptiveNetworkHardeningEnforceRequest()
                    .withRules(
                        Arrays
                            .asList(
                                new Rule()
                                    .withName("rule1")
                                    .withDirection(Direction.INBOUND)
                                    .withDestinationPort(3389)
                                    .withProtocols(Arrays.asList(TransportProtocol.TCP))
                                    .withIpAddresses(Arrays.asList("100.10.1.1", "200.20.2.2", "81.199.3.0/24")),
                                new Rule()
                                    .withName("rule2")
                                    .withDirection(Direction.INBOUND)
                                    .withDestinationPort(22)
                                    .withProtocols(Arrays.asList(TransportProtocol.TCP))
                                    .withIpAddresses(Arrays.asList())))
                    .withNetworkSecurityGroups(
                        Arrays
                            .asList(
                                "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/nsg1",
                                "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg2/providers/Microsoft.Network/networkSecurityGroups/nsg2")),
                com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/AdaptiveNetworkHardenings/EnforceAdaptiveNetworkHardeningRules_example.json
func ExampleAdaptiveNetworkHardeningsClient_BeginEnforce() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewAdaptiveNetworkHardeningsClient().BeginEnforce(ctx, "rg1", "Microsoft.Compute", "virtualMachines", "vm1", "default", armsecurity.AdaptiveNetworkHardeningEnforceRequest{
		NetworkSecurityGroups: []*string{
			to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/nsg1"),
			to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg2/providers/Microsoft.Network/networkSecurityGroups/nsg2")},
		Rules: []*armsecurity.Rule{
			{
				Name:            to.Ptr("rule1"),
				DestinationPort: to.Ptr[int32](3389),
				Direction:       to.Ptr(armsecurity.DirectionInbound),
				IPAddresses: []*string{
					to.Ptr("100.10.1.1"),
					to.Ptr("200.20.2.2"),
					to.Ptr("81.199.3.0/24")},
				Protocols: []*armsecurity.TransportProtocol{
					to.Ptr(armsecurity.TransportProtocolTCP)},
			},
			{
				Name:            to.Ptr("rule2"),
				DestinationPort: to.Ptr[int32](22),
				Direction:       to.Ptr(armsecurity.DirectionInbound),
				IPAddresses:     []*string{},
				Protocols: []*armsecurity.TransportProtocol{
					to.Ptr(armsecurity.TransportProtocolTCP)},
			}},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	_, err = poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Enforces the given rules on the NSG(s) listed in the request
 *
 * @summary Enforces the given rules on the NSG(s) listed in the request
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/AdaptiveNetworkHardenings/EnforceAdaptiveNetworkHardeningRules_example.json
 */
async function enforcesTheGivenRulesOnTheNsgSListedInTheRequest() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const resourceGroupName = process.env["SECURITY_RESOURCE_GROUP"] || "rg1";
  const resourceNamespace = "Microsoft.Compute";
  const resourceType = "virtualMachines";
  const resourceName = "vm1";
  const adaptiveNetworkHardeningResourceName = "default";
  const body = {
    networkSecurityGroups: [
      "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/nsg1",
      "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg2/providers/Microsoft.Network/networkSecurityGroups/nsg2",
    ],
    rules: [
      {
        name: "rule1",
        destinationPort: 3389,
        direction: "Inbound",
        ipAddresses: ["100.10.1.1", "200.20.2.2", "81.199.3.0/24"],
        protocols: ["TCP"],
      },
      {
        name: "rule2",
        destinationPort: 22,
        direction: "Inbound",
        ipAddresses: [],
        protocols: ["TCP"],
      },
    ],
  };
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const result = await client.adaptiveNetworkHardenings.beginEnforceAndWait(
    resourceGroupName,
    resourceNamespace,
    resourceType,
    resourceName,
    adaptiveNetworkHardeningResourceName,
    body,
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/AdaptiveNetworkHardenings/EnforceAdaptiveNetworkHardeningRules_example.json
// this example is just showing the usage of "AdaptiveNetworkHardenings_Enforce" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this AdaptiveNetworkHardeningResource created on azure
// for more information of creating AdaptiveNetworkHardeningResource, please refer to the document of AdaptiveNetworkHardeningResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
string resourceGroupName = "rg1";
string resourceNamespace = "Microsoft.Compute";
string resourceType = "virtualMachines";
string resourceName = "vm1";
string adaptiveNetworkHardeningResourceName = "default";
ResourceIdentifier adaptiveNetworkHardeningResourceId = AdaptiveNetworkHardeningResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, resourceNamespace, resourceType, resourceName, adaptiveNetworkHardeningResourceName);
AdaptiveNetworkHardeningResource adaptiveNetworkHardening = client.GetAdaptiveNetworkHardeningResource(adaptiveNetworkHardeningResourceId);

// invoke the operation
AdaptiveNetworkHardeningEnforceContent content = new AdaptiveNetworkHardeningEnforceContent(new RecommendedSecurityRule[]
{
new RecommendedSecurityRule()
{
Name = "rule1",
Direction = SecurityTrafficDirection.Inbound,
DestinationPort = 3389,
Protocols =
{
SecurityTransportProtocol.Tcp
},
IPAddresses =
{
"100.10.1.1","200.20.2.2","81.199.3.0/24"
},
},new RecommendedSecurityRule()
{
Name = "rule2",
Direction = SecurityTrafficDirection.Inbound,
DestinationPort = 22,
Protocols =
{
SecurityTransportProtocol.Tcp
},
IPAddresses =
{
},
}
}, new string[]
{
"/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/nsg1","/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/rg2/providers/Microsoft.Network/networkSecurityGroups/nsg2"
});
await adaptiveNetworkHardening.EnforceAsync(WaitUntil.Completed, content);

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample Response

Status code:: 200

Status code:: 202

Definíciók

Name	Description
AdaptiveNetworkHardeningEnforceAction	A megadott szabályok kényszerítése a kérelemben felsorolt NSG(k)en
AdaptiveNetworkHardeningEnforceRequest
CloudError	Az összes Azure Resource Manager API gyakori hibaválasza a sikertelen műveletek hibaadatainak visszaadásához. (Ez az OData hibaválasz formátumát is követi.)
CloudErrorBody	A hiba részletei.
direction	A szabály iránya
ErrorAdditionalInfo	Az erőforrás-kezelési hiba további információi.
Rule	Olyan távoli címeket ismertet, amelyek az Azure-erőforrással való kommunikációt javasolják egyes esetekben (protokoll, port, irány). Javasoljuk, hogy minden más távoli címet blokkoljon
transportProtocol	A szabály átviteli protokolljai

AdaptiveNetworkHardeningEnforceAction

A megadott szabályok kényszerítése a kérelemben felsorolt NSG(k)en

Name	Típus	Description
enforce	string

AdaptiveNetworkHardeningEnforceRequest

Name	Típus	Description
networkSecurityGroups	string[]	A hatályos hálózati biztonsági csoportok Azure-erőforrás-azonosítói, amelyek frissülnek az Adaptív hálózatmegerősítési szabályokból létrehozott biztonsági szabályokkal
rules	Rule[]	A kényszerítendő szabályok

CloudError

Az összes Azure Resource Manager API gyakori hibaválasza a sikertelen műveletek hibaadatainak visszaadásához. (Ez az OData hibaválasz formátumát is követi.)

Name	Típus	Description
error.additionalInfo	ErrorAdditionalInfo[]	A hiba további információi.
error.code	string	A hibakód.
error.details	CloudErrorBody[]	A hiba részletei.
error.message	string	A hibaüzenet.
error.target	string	A hibacél.

CloudErrorBody

A hiba részletei.

Name	Típus	Description
additionalInfo	ErrorAdditionalInfo[]	A hiba további információi.
code	string	A hibakód.
details	CloudErrorBody[]	A hiba részletei.
message	string	A hibaüzenet.
target	string	A hibacél.

direction

A szabály iránya

Name	Típus	Description
Inbound	string
Outbound	string

ErrorAdditionalInfo

Az erőforrás-kezelési hiba további információi.

Name	Típus	Description
info	object	A további információk.
type	string	A további információtípus.

Rule

Olyan távoli címeket ismertet, amelyek az Azure-erőforrással való kommunikációt javasolják egyes esetekben (protokoll, port, irány). Javasoljuk, hogy minden más távoli címet blokkoljon

Name	Típus	Description
destinationPort	integer	A szabály célportja
direction	direction	A szabály iránya
ipAddresses	string[]	Azok a távoli IP-címek, amelyeknek kommunikálniuk kell az Azure-erőforrással a szabály célportján és protokollján
name	string	A szabály neve
protocols	transportProtocol[]	A szabály átviteli protokolljai

transportProtocol

A szabály átviteli protokolljai

Name	Típus	Description
TCP	string
UDP	string

Megosztás a következőn keresztül:

Adaptive Network Hardenings - Enforce

URI-paraméterek

Kérelem törzse

Válaszok

Biztonság

azure_auth

Scopes

Példák

Enforces the given rules on the NSG(s) listed in the request

Sample Request

Sample Response

Definíciók

AdaptiveNetworkHardeningEnforceAction

AdaptiveNetworkHardeningEnforceRequest

CloudError

CloudErrorBody

direction

ErrorAdditionalInfo

Rule

transportProtocol

További források