What is Azure NSG?
You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol. For more details, you can refer to the documentation
Monitoring NSG flow logs are critical from a security perspective, especially in Public Clouds like Azure. vRealize LogInsight Cloud supports a number of Log Sources including Azure as well.
Once the logs are flowing you can create a Dashboard to visualize your Azure environment like the below sample dashboard
PRE-REQUISITES
In order to collect NSG logs, you will need following
- Blob Storage – It is an object storage solution for the Azure cloud. We will be using it to save the NSG flow logs. You can use an existing account however I will be demonstrating how to create one as well.
- Azure Network Watcher – It provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. We will be using the NSG flow logs feature of the Azure Network Watcher service that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can forward to external tools like vRealize Log Insight Cloud.
- vRLI Cloud Function – It is Custom ARM Template that will be deployed to fetch logs from Blob Storage and forward it to vRealize Log Insight Cloud. I will be demonstrating how to deploy this as part of this blog.
PROCEDURE
The following section includes step by step instructions to enable log forwarding of Azure NSG logs to vRealize Log Insight Cloud
Step 1 – Generate vRealize LogInsight Cloud API Key from here
Step 2 – Create Blob Storage & vRealize Log Insight Cloud Function
Log in to vRealize Log Insight Cloud, Navigate to Log Sources –> Azure –> Blob Storage –> Create a Blob Storage & Click Deploy to Azure
If you want to use existing Blob Storage then you will need to use ARM template under Map a Blob Storage. There are some additional configs to be done. This blog doesn\'t cover that. 
Provide Basic details such as Subscription, Resource Groups, API_URL, API_Token
For vRLI Cloud US API_URL would be following. It will change if you have in other regions.
https://data.mgmt.cloud.vmware.com/le-mans/v1/streams/ingestion-pipeline-stream
Step 3 – Configure Diagnostic Settings for Function App
This will save the logs for the Function in the Blob Storage and forward them to vRealize Log Insight Cloud.
Navigate to the Diagnostics Settings section under the monitoring tab of vRealize Log Insight Cloud Function (Name should start with \”VMwareLogsFunction\”) & Click Add Diagnostic Settings.
Provide basic details like Type of Logs, Retention Period and Select the Storage Account(Name should start with vmware)
Step 4 – Azure Blob Storage Trigger to fetch logs from Blob Storage
The Blob storage trigger starts a vRealize Log Insight Cloud function when a new or updated blob is detected.
Navigate to the Functions section under the Functions tab of vRealize Log Insight Cloud Function (Name should start with \”VMwareLogsFunction\”) & Click blobStorageFunction
Click the Integration tab under the Developer section and then click Azure Blob Storage Trigger to edit the trigger details
Step 5 – Configure NSG flow logs
Navigate to the NSG flow logs section under Logs of Network Watcher Service (In my case the NSG name is MMTest-nsg) and Click the NSG for which you want to modify the settings.
Perform following changes
- Change Status to ON
- Change Flow Logs Version to Version 2
- Select the Storage Account where you want the logs to be saved (Name should start with vmware). If you are using a v2 Storage Account you will specify Retention Days
Step 6 Verify Logs in vRealize LogInsight Cloud
If everything is successful you can search for logs using
log_type contains azure_log
You should be able to create a Dashboard to visualize your Azure environment like the below sample dashboard or you can create alerts to get notified whenever a suspicious activity happens.
