Analyzing Traffic to Azure VMs with Azure NSG Flow Logs

Azure Network Security Group (NSG) flow logs provide detailed information about the traffic that is flowing in and out of your Azure Virtual Machines (VMs). By using NSG flow logs, you can analyze traffic to your VMs and identify potential security threats or performance issues. The logs can be used to track the source and destination IP addresses, ports, protocols, and other details about the traffic. In this blog post, we will discuss how to use Azure NSG flow logs to analyze traffic to an Azure VM, including code examples.

The first step in setting up Azure NSG flow logs is to enable flow logs for your NSG. This can be done through the Azure portal or via Azure PowerShell. To enable flow logs via the Azure portal, navigate to the NSG that you want to monitor. In the settings, select "Flow logs" and then turn on the toggle switch to enable flow logging.

To enable flow logs via Azure PowerShell, you can use the following command:

Enable-AzNetworkSecurityGroupFlowLog -ResourceId <NSG-ID> -StorageAccountId <Storage-Account-ID> -Enabled $true

In the above command, replace <NSG-ID> with the resource ID of your NSG and <Storage-Account-ID> with the resource ID of the storage account where you want to store the logs.

After enabling flow logs, you'll need to configure a storage account to store the logs. This can be done through the Azure portal or via Azure PowerShell. To configure a storage account via the Azure portal, navigate to the NSG settings and select "Storage account." Then, create a new storage account or select an existing one.

To configure a storage account via Azure PowerShell, you can use the following command:

Set-AzNetworkSecurityGroupFlowLog -ResourceId <NSG-ID> -StorageAccountId <Storage-Account-ID>

In the above command, replace <NSG-ID> with the resource ID of your NSG and <Storage-Account-ID> with the resource ID of the storage account where you want to store the logs.

Once the logs are stored in a storage account, you can use Log Analytics to analyze the logs. To do this, you'll need to configure a Log Analytics workspace. This can be done through the Azure portal or via Azure PowerShell. To configure a Log Analytics workspace via the Azure portal, navigate to the NSG settings and select "Log Analytics workspace." Then, create a new workspace or select an existing one.

To configure a Log Analytics workspace via Azure PowerShell, you can use the following command:

New-AzDiagnosticSetting -ResourceId <NSG-ID> -WorkspaceId <Log-Analytics-Workspace-ID> -Enabled $true -Categories NetworkSecurityGroupEvent

In the above command, replace <NSG-ID> with the resource ID of your NSG and <Log-Analytics-Workspace-ID> with the resource ID of the Log Analytics workspace where you want to store the logs.

Once the Log Analytics workspace is configured, you can use Log Analytics queries to analyze the logs. There are many pre-built queries available that you can use to analyze the logs. You can also create custom queries to retrieve specific information from the logs. For example, the following query can be used to retrieve the top 10 source IP addresses that have generated the most traffic:

AzureDiagnostics
| where Category == "NetworkSecurityGroupFlowLog"
| summarize count() by src_ip
| top 10 by count_

You can also use Azure Monitor to create alerts that notify you when certain conditions are met. For example, you can create an alert that notifies you when the number of dropped packets exceeds a certain threshold. To create an alert, you can use the Azure portal or Azure PowerShell.

Finally, to visualize the data, you can create an Azure Dashboard and add the visualizations that you need. This will allow you to quickly identify trends and patterns in the traffic to your VM.

In summary, Azure NSG flow logs provide a powerful tool for analyzing traffic to an Azure VM. By enabling flow logs, configuring a storage account, and using Log Analytics to analyze the logs, you can identify potential security threats or performance issues and take action to resolve them. Additionally, by using Azure Monitor to create alerts and Azure Dashboard to visualize the data, you can quickly identify and respond to issues as they arise.

I hope this helps! Let me know if you have any questions.