You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -63,7 +63,7 @@ For a complete overview of the properties, you may read the [NSG Flow Logs templ
63
63
To create a Microsoft.Network/networkWatchers/flowLogs resource, add the above JSON to the resources section of your template.
64
64
65
65
66
-
## Creating your template
66
+
## Create your template
67
67
68
68
If you are using Azure Resource Manager templates for the first time, you can learn more about them using the links below.
69
69
@@ -143,7 +143,7 @@ Below are two examples of complete templates to set up NSG Flow Logs.
143
143
}
144
144
```
145
145
146
-
## Deploying your Azure Resource Manager template
146
+
## Deploy your Azure Resource Manager template
147
147
148
148
This tutorial assumes you have an existing Resource group and an NSG you can enable Flow logging on.
149
149
You can save any of the above example templates locally as `azuredeploy.json`. Update the property values so that they point to valid resources in your subscription.
> The above commands are deploying a resource to the NetworkWatcherRG resource group and not the resource group containing the NSG
161
161
162
162
163
-
## Verifying your deployment
163
+
## Verify your deployment
164
164
165
165
There are a couple of ways to check if your deployment has Succeeded. Your PowerShell console should show "ProvisioningState" as "Succeeded". Additionally, you can visit the [NSG Flow Logs portal page](https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/flowLogs) to confirm your changes. If there were issues with the deployment, take a look at [Troubleshoot common Azure deployment errors with Azure Resource Manager](../azure-resource-manager/templates/common-deployment-errors.md).
166
166
167
-
## Deleting your resource
167
+
## Delete your resource
168
168
Azure enables resource deletion through the "Complete" deployment mode. To delete a Flow Logs resource, specify a deployment in Complete mode without including the resource you wish to delete. Read more about the [Complete deployment mode](../azure-resource-manager/templates/deployment-modes.md#complete-mode)
Copy file name to clipboardExpand all lines: articles/network-watcher/nsg-flow-logs-policy-portal.md
+16-19Lines changed: 16 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,28 +1,25 @@
1
1
---
2
-
title: QuickStart - Deploy and manage NSG Flow Logs using Azure Policy
2
+
title: Deploy and manage NSG flow logs using Azure Policy
3
3
titleSuffix: Azure Network Watcher
4
-
description: This article explains how to use the built-in policies to manage the deployment of NSG flow logs
4
+
description: Learn how to use built-in policies to manage the deployment of network security group (NSG) flow logs.
5
5
services: network-watcher
6
6
author: halkazwini
7
7
ms.service: network-watcher
8
-
ms.topic: quickstart
8
+
ms.topic: how-to
9
9
ms.workload: infrastructure-services
10
10
ms.date: 02/09/2022
11
11
ms.author: halkazwini
12
12
ms.custom: engagement-fy23
13
13
---
14
14
15
-
# QuickStart: Deploy and manage NSG Flow Logs using Azure Policy
15
+
# Deploy and manage NSG flow logs using Azure Policy
16
16
17
-
## Overview
17
+
Azure Policy helps to enforce organizational standards and to assess compliance at scale. Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. In this article, we'll use two built-in policies available for NSG Flow Logs to manage your flow logs setup. The first policy flags any NSGs without flow logs enabled. The second policy automatically deploys Flow logs for NSGs without Flow logs enabled.
18
18
19
-
Azure Policy helps to enforce organizational standards and to assess compliance at scale. Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. In this article, we will use two built-in policies available for NSG Flow Logs to manage your flow logs setup. The first policy flags any NSGs without flow logs enabled. The second policy automatically deploys Flow logs for NSGs without Flow logs enabled.
20
-
21
-
If you are creating an Azure Policy definition for the first time, you can read through:
19
+
If you're creating an Azure Policy definition for the first time, you can read through:
4.Click the three dots menu under "Policy Definitions" to see available policies
39
+
4.Select the three dots menu under "Policy Definitions" to see available policies
43
40
44
41
5. Use the Type filter and choose "Built-in". Then search for "Flow log"
45
42
@@ -57,7 +54,7 @@ There are separate instructions for each policy below.
57
54
58
55
### How the policy works
59
56
60
-
The policy checks all existing ARM objects of type “Microsoft.Network/networkSecurityGroups”, that is it looks at all NSGs in a given scope, and checks for the existence of linked Flow logs via the Flow Logs property of the NSG. If the property does not exist, the NSG is flagged.
57
+
The policy checks all existing ARM objects of type “Microsoft.Network/networkSecurityGroups”, that is, it looks at all NSGs in a given scope, and checks for the existence of linked Flow logs via the Flow Logs property of the NSG. If the property doesn't exist, the NSG is flagged.
61
58
62
59
If you want to see the full definition of the policy, you can visit the [Definitions tab](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Definitions) and search for "Flow logs" to find the policy
63
60
@@ -69,9 +66,9 @@ If you want to see the full definition of the policy, you can visit the [Definit
69
66
- Policy Definition: Should be chosen as shown in the "Locate the policies" section.
70
67
- AssignmentName: Choose a descriptive name
71
68
72
-
2.Click on "Review + Create" to review your assignment
69
+
2.Select "Review + Create" to review your assignment
73
70
74
-
The policy does not require any parameters. As you are assigning an audit policy, you do not need to fill in the details in the "Remediation" tab.
71
+
The policy doesn't require any parameters. As you're assigning an audit policy, you don't need to fill in the details in the "Remediation" tab.
@@ -86,7 +83,7 @@ You should see something similar to the following screenshot once your policy ru
86
83
87
84
### Policy Structure
88
85
89
-
The policy checks all existing ARM objects of type “Microsoft.Network/networkSecurityGroups”, that is it looks at all NSGs in a given scope, and checks for the existence of linked Flow logs via the Flow Logs property of the NSG. If the property does not exist, the policy deploys a Flow log.
86
+
The policy checks all existing ARM objects of type “Microsoft.Network/networkSecurityGroups”, that is, it looks at all NSGs in a given scope, and checks for the existence of linked Flow logs via the Flow Logs property of the NSG. If the property doesn't exist, the policy deploys a Flow log.
90
87
91
88
If you want to see the full definition of the policy, you can visit the [Definitions tab](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Definitions) and search for "Flow logs" to find the policy.
92
89
@@ -103,7 +100,7 @@ If you want to see the full definition of the policy, you can visit the [Definit
103
100
The Network Watcher service is a regional service. These parameters allow the policy action of deploying flow logs to be executed.
104
101
- NSG Region: Azure regions at which the policy is targeted
105
102
- Storage ID: Full resource ID of the storage account. Note: This storage account should be in the same region as the NSG.
106
-
- Network Watchers RG: Name of the resource group containing your Network Watcher resource. If you have not renamed it, you can enter `NetworkWatcherRG` which is the default.
103
+
- Network Watchers RG: Name of the resource group containing your Network Watcher resource. If you haven't renamed it, you can enter `NetworkWatcherRG` which is the default.
107
104
- Network Watcher name: Name of the regional network watcher service. Format: NetworkWatcher_RegionName. Example: NetworkWatcher_centralus. See the full list.
@@ -135,4 +132,4 @@ You should see something like the following screenshot once your policy. In case
135
132
136
133
- Learn about [Traffic Analytics Built-in Policies](./traffic-analytics-policy-portal.md)
137
134
- Use this [tutorial](./quickstart-configure-network-security-group-flow-logs-from-arm-template.md) Go deeper by using ARM templates to deploy Flow Logs and Traffic Analytics.
0 commit comments