Microsoft Azure NSG flow logs¶

With Azure NSG flow log ingestion enabled, Plixer Scrutinizer can monitor and run reports on IP traffic traversing an NSG.

Once NSG flow data is being received, the following additional report types can be run:

Flow Decisions

Aggregation based on decision (accept or deny) applied to traffic via NSG rules

Flow Decisions Count

Flow count aggregation for each NSG traffic decision

Flow States

Aggregation based on distinct states reported for individual network flows

Flow States Count

Flow count aggregation for each network flow state

NSG All Details

Aggregation based on full range of flow details, including the NSG rule and application associated with the traffic

Resource IDs

Aggregation based on NSG resource IDs

Setting up Azure blob storage

Before setting up NSG flow log ingestion in Plixer Scrutinizer, the Azure Storage blob container(s) that will be used used should be configured as follows:

  • Set the NSG(s) to be monitored to send flow logs to the container. Both version 1 and version 2 flow logs are supported, but the latter format is recommended to enable volume-based reports.

  • The container should be reserved for exclusive use by Plixer Scrutinizer. If the flow logs need to be archived or used for other purposes, send the flow logs to a separate blob container, and then automate the replication/duplication of those logs to the container that will be used by Plixer Scrutinizer.

  • Versioning should be disabled.

Note

Once a blob container is configured for NSG flow log ingestion, Plixer Scrutinizer will routinely collect the most recent 15 minutes of logs and delete all inactive log files (i.e., not updated in the past ~1 hour). If any historical data needs to be retained, it should be copied off the container before the integration is configured. Manually clearing the container of inactive log files will also allow Plixer Scrutinizer to become current more quickly.

Configuring NSG flow log ingestion

To add an Azure Storage blob container as a flow log ingestion source in Plixer Scrutinizer, follow these steps:

  1. Navigate to Admin > Integrations > Flow Log Ingestion in the web interface.

  2. Click the + button, and then select Azure NSG FlowLogs in the tray.

  3. In the secondary tray, configure the container for flow log ingestion as follows:

    • Enter a name to identify the bucket/source by.

    • Enter the container name (in most cases, insights-logs-networksecuritygroupflowevent).

    • Select the collector to assign to the container from the dropdown.

    • Enter the storage account name and key to use to access the container (in most cases, the service URL host name without .blob.core.windows.net/ or another domain)

    • Enter the service URL for the container (in most cases, formatted as https://STORAGE-ACCOUNT-NAME.blob.core.windows.net/).

  4. Click the Save button to add the container with the current settings.

Once added, the container will be listed in the main Admin > Integrations > Flow Log Ingestion view under the configured name. An exporter associated with the NSG will also be added to the device lists for Plixer Scrutinizer’s various functions (Flow Analytics, network maps, reports, etc.).

Note

  • To verify that an Azure NSG flow log source has been successfully added, look for an exporter whose hostname matches the NSG in the Explore > Exporters > By Exporters view or the Admin > Resources > Manage Exporters page (after ~1 hour).

  • In distributed environments, avoid using the primary reporter as the collector for the container.

For assistance with any issues, consult the troubleshooting guide or contact Plixer Technical Support.