Skip to content

Commit 1f64a1f

Browse files
Merge pull request #282363 from halkazwini/nw-kibana
Update Kibana JSON file links
2 parents d202095 + 15b2861 commit 1f64a1f

File tree

1 file changed

+9
-10
lines changed

1 file changed

+9
-10
lines changed

articles/network-watcher/network-watcher-visualize-nsg-flow-logs-open-source-tools.md

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,31 @@
11
---
22
title: Visualize NSG flow logs - Elastic Stack
33
titleSuffix: Azure Network Watcher
4-
description: Manage and analyze Network Security Group Flow Logs in Azure using Network Watcher and Elastic Stack.
5-
services: network-watcher
4+
description: Manage and analyze network security group Flow Logs in Azure using Network Watcher and Elastic Stack.
65
author: halkazwini
76
ms.service: network-watcher
87
ms.topic: how-to
9-
ms.date: 05/31/2024
8+
ms.date: 07/30/2024
109
ms.author: halkazwini
1110
---
1211

1312
# Visualize Azure Network Watcher NSG flow logs using open source tools
1413

15-
Network Security Group flow logs provide information that can be used understand ingress and egress IP traffic on Network Security Groups. These flow logs show outbound and inbound flows on a per rule basis, the NIC the flow applies to, 5-tuple information about the flow (Source/Destination IP, Source/Destination Port, Protocol), and if the traffic was allowed or denied.
14+
Network security group flow logs provide information that can be used understand ingress and egress IP traffic on network security groups. These flow logs show outbound and inbound flows on a per rule basis, the NIC the flow applies to, 5-tuple information about the flow (Source/Destination IP, Source/Destination Port, Protocol), and if the traffic was allowed or denied.
1615

1716
These flow logs can be difficult to manually parse and gain insights from. However, there are several open source tools that can help visualize this data. This article provides a solution to visualize these logs using the Elastic Stack, which allows you to quickly index and visualize your flow logs on a Kibana dashboard.
1817

1918
## Scenario
2019

21-
In this article, we set up a solution that allows you to visualize Network Security Group flow logs using the Elastic Stack. A Logstash input plugin obtains the flow logs directly from the storage blob configured for containing the flow logs. Then, using the Elastic Stack, the flow logs are indexed and used to create a Kibana dashboard to visualize the information.
20+
In this article, we set up a solution that allows you to visualize network security group flow logs using the Elastic Stack. A Logstash input plugin obtains the flow logs directly from the storage blob configured for containing the flow logs. Then, using the Elastic Stack, the flow logs are indexed and used to create a Kibana dashboard to visualize the information.
2221

23-
![Diagram shows a scenario that allows you to visualize Network Security Group flow logs using the Elastic Stack.][scenario]
22+
![Diagram shows a scenario that allows you to visualize network security group flow logs using the Elastic Stack.][scenario]
2423

2524
## Steps
2625

27-
### Enable Network Security Group flow logging
26+
### Enable network security group flow logging
2827

29-
For this scenario, you must have Network Security Group Flow Logging enabled on at least one Network Security Group in your account. For instructions on enabling Network Security Flow Logs, see the following article [Introduction to flow logging for Network Security Groups](nsg-flow-logs-overview.md).
28+
For this scenario, you must have network security group Flow Logging enabled on at least one network security group in your account. For instructions on enabling Network Security Flow Logs, see the following article [Introduction to flow logging for network security groups](nsg-flow-logs-overview.md).
3029

3130
### Set up the Elastic Stack
3231

@@ -206,7 +205,7 @@ A sample dashboard to view trends and details in your alerts is shown in the fol
206205
207206
![figure 1][1]
208207
209-
Download the [dashboard file](https://aka.ms/networkwatchernsgflowlogdashboard), the [visualization file](https://aka.ms/networkwatchernsgflowlogvisualizations), and the [saved search file](https://aka.ms/networkwatchernsgflowlogsearch).
208+
Download the [dashboard file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Dashboard.json), the [visualization file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Visualizations.json), and the [saved search file](https://github.com/Azure/NWPublicScripts/blob/main/nw-public-docs-artifacts/nsg-flow-logs/kibana/Sample_NSG_Flowlog_Saved_Search.json).
210209
211210
Under the **Management** tab of Kibana, navigate to **Saved Objects** and import all three files. Then from the **Dashboard** tab you can open and load the sample dashboard.
212211
@@ -244,7 +243,7 @@ Using the query bar at the top of the dashboard, you can filter down the dashboa
244243
245244
## Conclusion
246245
247-
By combining the Network Security Group flow logs with the Elastic Stack, we have come up with powerful and customizable way to visualize our network traffic. These dashboards allow you to quickly gain and share insights about your network traffic, and filter down and investigate on any potential anomalies. Using Kibana, you can tailor these dashboards and create specific visualizations to meet any security, audit, and compliance needs.
246+
By combining the network security group flow logs with the Elastic Stack, we have come up with powerful and customizable way to visualize our network traffic. These dashboards allow you to quickly gain and share insights about your network traffic, and filter down and investigate on any potential anomalies. Using Kibana, you can tailor these dashboards and create specific visualizations to meet any security, audit, and compliance needs.
248247
249248
## Next steps
250249

0 commit comments

Comments
 (0)