Microsoft Azure NSG Flow

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About the Device

Microsoft Azure Network Security Group Flow Logs are a feature of Azure Network Watcher that provide information about ingress and egress IP traffic through a configured Network Security Group.

While Virtual Network (VNET) is the cornerstone of Azure networking model and provides isolation and protection. Network Security Group (NSG) is the main tool you need to use to enforce and control network traffic rules at the networking level. Customers can control access by permitting or denying communication between the workloads within a virtual network, from systems on customer’s networks via cross-premises connectivity, or direct Internet communication. In the diagram below, both VNETs and NSGs reside in a specific layer in the Azure overall security stack, where NSGs, UDR, and network virtual appliances can be used to create security boundaries to protect the application deployments in the protected network.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Microsoft
Product Name	Azure NSG Flow
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
Microsoft Azure NSG Flow	AZURE_NSG_FLOW	Storage - JSON	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure_blobstore

Device Configuration

Prerequisites:

An Azure subscription that you can sign in to.
A user who's a Global Administrator or Network Administrator.
Azure Storage Account to store the logs

Reference URLs:

How to create storage account: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal

Make sure all your VM's that needs to be monitored, belong to Network Security Groups for which flow logging is enabled
List of NSG's to be monitored is taken at the time of collector initialization, in case the customer adds any new NSG, to monitor the same collector needs to be restarted.
Adaptive MxDR registration is based on subscription ID & Storage account combination, in case of multiple subscriptions, repeat all the steps below for each subscription.

To Register Insights Provider

NSG flow logging requires the Microsoft.Insights provider. To register the provider, complete the following steps:

Log in to the Azure portal at https://portal.azure.com.
In the top left corner of portal, select All services. In the Filter, type Subscriptions. When Subscriptions appear in the search results, select it.
From the list of subscriptions, select the subscription you want to enable the provider for.
Select Resource providers, under Settings.
Confirm that the STATUS for the microsoft.insights provider is Registered. If the status is Unregistered, then select Register.

To Enable NSG Flow Log

NSG flow log data is written to an Azure Storage account. It is recommended to create a separate Azure Storage account for flow logs as this will keep the logging intact even if any resource group is deleted, select + Create a resource at the top left corner of the portal.
Create a storage account: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal

The storage account may take around a minute to create. Don't continue with remaining steps until the storage account is created. If you use an existing storage account instead of creating one, ensure you select a storage account that has All networks (default) selected for Firewalls and virtual networks, under the Settings for the storage account.

In the top left corner of portal, select All services. In the Filter, type Network Watcher. When Network Watcher appears in the search results, select it.
In LOGS, select NSG flow logs and select subscription that needs to be monitored.

From the list of NSGs, select the NSG you want to enable flow logging for.
In Flow logs settings, select On.
Select the Storage account created in Step 2.
Set Retention (days) to 3 and click Save.

Repeat Steps 5-8 in case of multiple NSG's, but make sure to select only one storage account for all NSGs.

After completing the previous steps, take a moment and then navigate to All Services > Storage accounts > select the storage account used above and under Blob Service select Blobs.
If all configurations are accurate and flow logs are being received as expected, you should see a container named "insights-logs-networksecuritygroupflowevent" inside the blob.
Use below link to see, how you can get credentials of Azure Storage:

Integration Parameters

Property	Default Value	Description

Property	Default Value	Description
AZURE URI	N/A	The URI pointing to a Azure Blob Storage blob or container. Container names are `insights-logs-signinlogs` , `insights-logs-auditlogs` & `RiskyUsers`
URI IS A	Directory which includes subdirectories	The type of object indicated by the URI. Valid values are: `FILES`: The URI points to a single blob that will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a Blob Storage container.
SOURCE DELETION OPTION	Never delete files	Source file deletion is not supported in Azure. This field's value must be set to `SOURCE_DELETION_NEVER`.
Shared Key OR SAS Token	N/A	A shared key, a 512-bit random string in base64 encoding, authorized to access Azure Blob Storage. Required if not specifying an SAS Token. OR A Shared Access Signature authorized to access the Azure Blob Storage container.