Skip to content

Commit 06f659d

Browse files
v-ksreedevanv-ksreedevan
committed
Edits
1 parent 316d7e3 commit 06f659d

File tree

1 file changed

+82
-150
lines changed

1 file changed

+82
-150
lines changed

‎articles/network-watcher/network-watcher-alert-triggered-packet-capture.md

Lines changed: 82 additions & 150 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: network-watcher
88
ms.topic: how-to
99
ms.tgt_pltfrm: na
1010
ms.workload: infrastructure-services
11-
ms.date: 12/16/2022
11+
ms.date: 12/28/2022
1212
ms.author: shijaiswal
1313
ms.custom: devx-track-azurepowershell, engagement-fy23
1414

@@ -209,188 +209,120 @@ It's now time to make calls into Network Watcher from within the Azure function.
209209
The following example is PowerShell code that can be used in the function. There are values that need to be replaced for **subscriptionId**, **resourceGroupName**, and **storageAccountName**.
210210

211211
```powershell
212-
#Import Azure PowerShell modules required to make calls to Network Watcher
213-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Accounts\Az.Accounts.psd1" -Global
214-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Network\Az.Network.psd1" -Global
215-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Resources\Az.Resources.psd1" -Global
212+
# Input bindings are passed in via param block.
213+
param($Request, $TriggerMetadata)
216214
217-
# Input bindings are passed in via param block.
218-
param($Request, $TriggerMetadata)
215+
$essentials = $Request.body.data.essentials
216+
$alertContext = $Request.body.data.alertContext
219217
220-
$essentials = $Request.body.data.essentials
221-
$alertContext = $Request.body.data.alertContext
222218
219+
# Storage account ID to save captures in
220+
$storageaccountid = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
223221
224-
# Storage account ID to save captures in
225-
$storageaccountid = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
222+
# Packet capture vars
223+
$packetCaptureName = "PSAzureFunction"
224+
$packetCaptureLimit = 100
225+
$packetCaptureDuration = 30
226226
227-
# Packet capture vars
228-
$packetCaptureName = "PSAzureFunction"
229-
$packetCaptureLimit = 100
230-
$packetCaptureDuration = 30
227+
# Credentials
228+
# Set the credentials in the Configurations
229+
$tenant = $env:AzureTenant
230+
$pw = $env:AzureCredPassword
231+
$clientid = $env:AzureClientId
232+
$password = ConvertTo-SecureString $pw -AsPlainText -Force
233+
$credential = New-Object System.Management.Automation.PSCredential ($clientid, $password)
231234
232-
# Credentials
233-
# Set the credentials in the Configurations
234-
$tenant = $env:AzureTenant
235-
$pw = $env:AzureCredPassword
236-
$clientid = $env:AzureClientId
235+
Connect-AzAccount -ServicePrincipal -Tenant $tenant -Credential $credential #-WarningAction SilentlyContinue | out-null
237236
238-
$password = ConvertTo-SecureString $pw -AsPlainText -Force
239-
$credential = New-Object System.Management.Automation.PSCredential ($clientid, $password)
237+
if ($alertContext.condition.allOf.metricNamespace -eq "Microsoft.Compute/virtualMachines") {
240238
241-
# Credentials can also be provided as encrypted key file as mentioned below
242-
# $keypath = "D:\home\site\wwwroot\AlertPacketCapturePowerShell\keys\PassEncryptKey.key"
243-
# $secpassword = $pw | ConvertTo-SecureString -Key (Get-Content $keypath)
244-
# $credential = New-Object System.Management.Automation.PSCredential ($clientid, $secpassword)
239+
# Get the VM firing this alert
240+
$vm = Get-AzVM -ResourceId $essentials.alertTargetIDs[0]
245241
242+
# Get the Network Watcher in the VM's region
243+
$networkWatcher = Get-AzNetworkWatcher -Location $vm.Location
246244
247-
Connect-AzAccount -ServicePrincipal -Tenant $tenant -Credential $credential #-WarningAction SilentlyContinue | out-null
245+
# Get existing packetCaptures
246+
$packetCaptures = Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher
248247
249-
if ($alertContext.condition.allOf.metricNamespace -eq "Microsoft.Compute/virtualMachines") {
250-
251-
# Get the VM firing this alert
252-
$vm = Get-AzVM -ResourceId $essentials.alertTargetIDs[0]
253-
254-
# Get the Network Watcher in the VM's region
255-
$networkWatcher = Get-AzNetworkWatcher -Location $vm.Location
256-
257-
# Get existing packetCaptures
258-
$packetCaptures = Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher
259-
260-
# Remove existing packet capture created by the function (if it exists)
261-
$packetCaptures | ForEach-Object { if ($_.Name -eq $packetCaptureName)
262-
{
263-
Remove-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCaptureName $packetCaptureName
264-
}
265-
}
248+
# Remove existing packet capture created by the function (if it exists)
249+
$packetCaptures | ForEach-Object { if ($_.Name -eq $packetCaptureName)
250+
{
251+
Remove-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCaptureName $packetCaptureName
252+
}
253+
}
266254
267-
# Initiate packet capture on the VM that fired the alert
268-
if ($packetCaptures.Count -lt $packetCaptureLimit) {
269-
Write-Output "Initiating Packet Capture"
270-
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $vm.Id -PacketCaptureName $packetCaptureName -StorageAccountId $storageaccountid -TimeLimitInSeconds $packetCaptureDuration
271-
}
272-
}
255+
# Initiate packet capture on the VM that fired the alert
256+
if ($packetCaptures.Count -lt $packetCaptureLimit) {
257+
Write-Output "Initiating Packet Capture"
258+
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $vm.Id -PacketCaptureName $packetCaptureName -StorageAccountId $storageaccountid -TimeLimitInSeconds $packetCaptureDuration
259+
}
260+
}
273261
```
274262

275263
Use the following PowerShell code if you're using the old schema:
276264

277265
```powershell
278-
#Import Azure PowerShell modules required to make calls to Network Watcher
279-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Accounts\Az.Accounts.psd1" -Global
280-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Network\Az.Network.psd1" -Global
281-
Import-Module "D:\home\site\wwwroot\AlertPacketCapturePowerShell\azuremodules\Az.Resources\Az.Resources.psd1" -Global
282-
283-
# Input bindings are passed in via param block.
284-
param($Request, $TriggerMetadata)
285-
$details = $Request.RawBody | ConvertFrom-Json
286-
287-
288-
# Process alert request body
289-
$requestBody = $Request.Body.data
290-
291-
# Storage account ID to save captures in
292-
$storageaccountid = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
293-
294-
# Packet capture vars
295-
$packetCaptureName = "PSAzureFunction"
296-
$packetCaptureLimit = 100
297-
$packetCaptureDuration = 30
298-
299-
# Credentials
300-
# Set the credentials in the Configurations
301-
$tenant = $env:AzureTenant
302-
$pw = $env:AzureCredPassword
303-
$clientid = $env:AzureClientId
304-
305-
$password = ConvertTo-SecureString $pw -AsPlainText -Force
306-
$credential = New-Object System.Management.Automation.PSCredential ($clientid, $password)
307-
308-
# Credentials can also be provided as encrypted key file as mentioned below
309-
# $keypath = "D:\home\site\wwwroot\AlertPacketCapturePowerShell\keys\PassEncryptKey.key"
310-
# $secpassword = $pw | ConvertTo-SecureString -Key (Get-Content $keypath)
311-
# $credential = New-Object System.Management.Automation.PSCredential ($clientid, $secpassword)
312-
313-
314-
Connect-AzAccount -ServicePrincipal -Tenant $tenant -Credential $credential #-WarningAction SilentlyContinue | out-null
315-
316-
if ($requestBody.context.resourceType -eq "Microsoft.Compute/virtualMachines") {
317-
318-
# Get the VM firing this alert
319-
$vm = Get-AzVM -ResourceGroupName $requestBody.context.resourceGroupName -Name $requestBody.context.resourceName
320-
321-
# Get the Network Watcher in the VM's region
322-
$networkWatcher = Get-AzNetworkWatcher -Location $vm.Location
323-
324-
# Get existing packetCaptures
325-
# $packetCaptures = Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher
266+
# Input bindings are passed in via param block.
267+
param($Request, $TriggerMetadata)
268+
$details = $Request.RawBody | ConvertFrom-Json
326269
327-
# Remove existing packet capture created by the function (if it exists)
328-
$packetCaptures | ForEach-Object { if ($_.Name -eq $packetCaptureName)
329-
{
330-
Remove-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCaptureName $packetCaptureName
331-
}
332-
}
333270
334-
# Initiate packet capture on the VM that fired the alert
335-
if ($packetCaptures.Count -lt $packetCaptureLimit) {
336-
Write-Output "Initiating Packet Capture"
337-
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $requestBody.context.resourceId -PacketCaptureName $packetCaptureName -StorageAccountId $storageaccountid -TimeLimitInSeconds $packetCaptureDuration
338-
}
339-
}
271+
# Process alert request body
272+
$requestBody = $Request.Body.data
340273
341-
$essentials = $Request.body.data.essentials
342-
$alertContext = $Request.body.data.alertContext
274+
# Storage account ID to save captures in
275+
$storageaccountid = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
343276
277+
# Packet capture vars
278+
$packetCaptureName = "PSAzureFunction"
279+
$packetCaptureLimit = 100
280+
$packetCaptureDuration = 30
344281
345-
# Storage account ID to save captures in
346-
$storageaccountid = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
282+
# Credentials
283+
# Set the credentials in the Configurations
284+
$tenant = $env:AzureTenant
285+
$pw = $env:AzureCredPassword
286+
$clientid = $env:AzureClientId
347287
348-
# Packet capture vars
349-
$packetCaptureName = "PSAzureFunction"
350-
$packetCaptureLimit = 100
351-
$packetCaptureDuration = 30
288+
$password = ConvertTo-SecureString $pw -AsPlainText -Force
289+
$credential = New-Object System.Management.Automation.PSCredential ($clientid, $password)
352290
353-
# Credentials
354-
# Set the credentials in the Configurations
355-
$tenant = $env:AzureTenant
356-
$pw = $env:AzureCredPassword
357-
$clientid = $env:AzureClientId
291+
# Credentials can also be provided as encrypted key file as mentioned below
292+
# $keypath = "D:\home\site\wwwroot\AlertPacketCapturePowerShell\keys\PassEncryptKey.key"
293+
# $secpassword = $pw | ConvertTo-SecureString -Key (Get-Content $keypath)
294+
# $credential = New-Object System.Management.Automation.PSCredential ($clientid, $secpassword)
358295
359-
$password = ConvertTo-SecureString $pw -AsPlainText -Force
360-
$credential = New-Object System.Management.Automation.PSCredential ($clientid, $password)
361296
362-
# Credentials can also be provided as encrypted key file as mentioned below
363-
# $keypath = "D:\home\site\wwwroot\AlertPacketCapturePowerShell\keys\PassEncryptKey.key"
364-
# $secpassword = $pw | ConvertTo-SecureString -Key (Get-Content $keypath)
365-
# $credential = New-Object System.Management.Automation.PSCredential ($clientid, $secpassword)
297+
Connect-AzAccount -ServicePrincipal -Tenant $tenant -Credential $credential #-WarningAction SilentlyContinue | out-null
366298
299+
if ($requestBody.context.resourceType -eq "Microsoft.Compute/virtualMachines") {
367300
368-
Connect-AzAccount -ServicePrincipal -Tenant $tenant -Credential $credential #-WarningAction SilentlyContinue | out-null
301+
# Get the VM firing this alert
302+
$vm = Get-AzVM -ResourceGroupName $requestBody.context.resourceGroupName -Name $requestBody.context.resourceName
369303
370-
if ($alertContext.condition.allOf.metricNamespace -eq "Microsoft.Compute/virtualMachines") {
304+
# Get the Network Watcher in the VM's region
305+
$networkWatcher = Get-AzNetworkWatcher -Location $vm.Location
371306
372-
# Get the VM firing this alert
373-
$vm = Get-AzVM -ResourceId $essentials.alertTargetIDs[0]
307+
# Get existing packetCaptures
308+
# $packetCaptures = Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher
374309
375-
# Get the Network Watcher in the VM's region
376-
$networkWatcher = Get-AzNetworkWatcher -Location $vm.Location
310+
# Remove existing packet capture created by the function (if it exists)
311+
$packetCaptures | ForEach-Object { if ($_.Name -eq $packetCaptureName)
312+
{
313+
Remove-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCaptureName $packetCaptureName
314+
}
315+
}
377316
378-
# Get existing packetCaptures
379-
$packetCaptures = Get-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher
317+
# Initiate packet capture on the VM that fired the alert
318+
if ($packetCaptures.Count -lt $packetCaptureLimit) {
319+
Write-Output "Initiating Packet Capture"
320+
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $requestBody.context.resourceId -PacketCaptureName $packetCaptureName -StorageAccountId $storageaccountid -TimeLimitInSeconds $packetCaptureDuration
321+
}
322+
}
323+
380324
381-
# Remove existing packet capture created by the function (if it exists)
382-
$packetCaptures | ForEach-Object { if ($_.Name -eq $packetCaptureName)
383-
{
384-
Remove-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -PacketCaptureName $packetCaptureName
385-
}
386-
}
387-
388-
# Initiate packet capture on the VM that fired the alert
389-
if ($packetCaptures.Count -lt $packetCaptureLimit) {
390-
Write-Output "Initiating Packet Capture"
391-
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $vm.Id -PacketCaptureName $packetCaptureName -StorageAccountId $storageaccountid -TimeLimitInSeconds $packetCaptureDuration
392-
}
393-
}
325+
394326
```
395327

396328

0 commit comments

Comments
 (0)