|
1 | 1 | ---
|
2 | 2 | title: Visualize NSG flow logs - Elastic Stack
|
3 | 3 | titleSuffix: Azure Network Watcher
|
4 |
| -description: Manage and analyze Network Security Group Flow Logs in Azure using Network Watcher and Elastic Stack. |
5 |
| -services: network-watcher |
| 4 | +description: Manage and analyze network security group Flow Logs in Azure using Network Watcher and Elastic Stack. |
6 | 5 | author: halkazwini
|
7 | 6 | ms.service: network-watcher
|
8 | 7 | ms.topic: how-to
|
9 |
| -ms.date: 05/31/2024 |
| 8 | +ms.date: 07/30/2024 |
10 | 9 | ms.author: halkazwini
|
11 | 10 | ---
|
12 | 11 |
|
13 | 12 | # Visualize Azure Network Watcher NSG flow logs using open source tools
|
14 | 13 |
|
15 |
| -Network Security Group flow logs provide information that can be used understand ingress and egress IP traffic on Network Security Groups. These flow logs show outbound and inbound flows on a per rule basis, the NIC the flow applies to, 5-tuple information about the flow (Source/Destination IP, Source/Destination Port, Protocol), and if the traffic was allowed or denied. |
| 14 | +Network security group flow logs provide information that can be used understand ingress and egress IP traffic on network security groups. These flow logs show outbound and inbound flows on a per rule basis, the NIC the flow applies to, 5-tuple information about the flow (Source/Destination IP, Source/Destination Port, Protocol), and if the traffic was allowed or denied. |
16 | 15 |
|
17 | 16 | These flow logs can be difficult to manually parse and gain insights from. However, there are several open source tools that can help visualize this data. This article provides a solution to visualize these logs using the Elastic Stack, which allows you to quickly index and visualize your flow logs on a Kibana dashboard.
|
18 | 17 |
|
19 | 18 | ## Scenario
|
20 | 19 |
|
21 |
| -In this article, we set up a solution that allows you to visualize Network Security Group flow logs using the Elastic Stack. A Logstash input plugin obtains the flow logs directly from the storage blob configured for containing the flow logs. Then, using the Elastic Stack, the flow logs are indexed and used to create a Kibana dashboard to visualize the information. |
| 20 | +In this article, we set up a solution that allows you to visualize network security group flow logs using the Elastic Stack. A Logstash input plugin obtains the flow logs directly from the storage blob configured for containing the flow logs. Then, using the Elastic Stack, the flow logs are indexed and used to create a Kibana dashboard to visualize the information. |
22 | 21 |
|
23 |
| -![Diagram shows a scenario that allows you to visualize Network Security Group flow logs using the Elastic Stack.][scenario] |
| 22 | +![Diagram shows a scenario that allows you to visualize network security group flow logs using the Elastic Stack.][scenario] |
24 | 23 |
|
25 | 24 | ## Steps
|
26 | 25 |
|
27 |
| -### Enable Network Security Group flow logging |
| 26 | +### Enable network security group flow logging |
28 | 27 |
|
29 |
| -For this scenario, you must have Network Security Group Flow Logging enabled on at least one Network Security Group in your account. For instructions on enabling Network Security Flow Logs, see the following article [Introduction to flow logging for Network Security Groups](nsg-flow-logs-overview.md). |
| 28 | +For this scenario, you must have network security group Flow Logging enabled on at least one network security group in your account. For instructions on enabling Network Security Flow Logs, see the following article [Introduction to flow logging for network security groups](nsg-flow-logs-overview.md). |
30 | 29 |
|
31 | 30 | ### Set up the Elastic Stack
|
32 | 31 |
|
@@ -206,7 +205,7 @@ A sample dashboard to view trends and details in your alerts is shown in the fol
|
206 | 205 |
|
207 | 206 | ![figure 1][1]
|
208 | 207 |
|
209 |
| -Download the [dashboard file](https://aka.ms/networkwatchernsgflowlogdashboard), the [visualization file](https://aka.ms/networkwatchernsgflowlogvisualizations), and the [saved search file](https://aka.ms/networkwatchernsgflowlogsearch). |
| 208 | +Download the [dashboard file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Dashboard.json), the [visualization file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Visualizations.json), and the [saved search file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Saved_Search.json). |
210 | 209 |
|
211 | 210 | Under the **Management** tab of Kibana, navigate to **Saved Objects** and import all three files. Then from the **Dashboard** tab you can open and load the sample dashboard.
|
212 | 211 |
|
@@ -244,7 +243,7 @@ Using the query bar at the top of the dashboard, you can filter down the dashboa
|
244 | 243 |
|
245 | 244 | ## Conclusion
|
246 | 245 |
|
247 |
| -By combining the Network Security Group flow logs with the Elastic Stack, we have come up with powerful and customizable way to visualize our network traffic. These dashboards allow you to quickly gain and share insights about your network traffic, and filter down and investigate on any potential anomalies. Using Kibana, you can tailor these dashboards and create specific visualizations to meet any security, audit, and compliance needs. |
| 246 | +By combining the network security group flow logs with the Elastic Stack, we have come up with powerful and customizable way to visualize our network traffic. These dashboards allow you to quickly gain and share insights about your network traffic, and filter down and investigate on any potential anomalies. Using Kibana, you can tailor these dashboards and create specific visualizations to meet any security, audit, and compliance needs. |
248 | 247 |
|
249 | 248 | ## Next steps
|
250 | 249 |
|
|
0 commit comments