Skip to content

Commit 7368057

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #302428 from ChaithanyaRai/patch-99
[Azure Doc-a-thon] Update network-security-perimeter-diagnostic-logs.md
2 parents 940f3f8 + 7b5ca4b commit 7368057

File tree

1 file changed

+134
-1
lines changed

1 file changed

+134
-1
lines changed

‎articles/private-link/network-security-perimeter-diagnostic-logs.md

Lines changed: 134 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,142 @@ Access logs categories for a network security perimeter are based on the results
3939
> [!NOTE]
4040
> The available access modes for a network security perimeter are **Transition** and **Enforced**. The **Transition** mode was previously named **Learning** mode. You may continue to see references to **Learning** mode in some instances.
4141
42+
## Access log schema
43+
44+
Every PaaS resource associated with the network security perimeter, generates access log(s) with unified log schema when enabled.
45+
> [!NOTE]
46+
> Network security perimeter access logs may have been aggregated. If the fields 'count' and 'timeGeneratedEndTime' are missing, consider the aggregation count as 1.
47+
48+
| **Value** | **Description** |
49+
| --- | --- |
50+
| **time** | The timestamp (UTC) of the first event in log aggregation window. |
51+
| **timeGeneratedEndTime** | The timestamp (UTC) of the last event in the log aggregation window. |
52+
| **count** | Number of logs aggregated. |
53+
| **resourceId** | The resource Id of the network security perimeter.|
54+
| **location** | The region of network security perimeter.|
55+
| **operationName** | The name of the PaaS resource operation represented by this event. |
56+
| **operationVersion** | The api-version associated with the operation. |
57+
| **category** | Log categories defined for Access logs. |
58+
| **properties** | Network security perimeter specific extended properties related to this category of events.|
59+
| **resultDescription** | The static text description of this operation on the PaaS resource, e.g. “Get storage file.” |
60+
61+
## Network security perimeter specific properties
62+
63+
This section describes the network security perimeter specific properties in the log schema.
64+
> [!NOTE]
65+
> Application of the properties is subjected to log category type. Do refer respective log category schemas for applicability.
66+
67+
| **Value** | **Description** |
68+
| --- | --- |
69+
| **serviceResourceId** | Resource ID of PaaS resource emitting network security perimeter access logs. |
70+
| **serviceFqdn** | Fully Qualified Domain Name of PaaS resource emitting network security perimeter access logs. |
71+
| **profile** | Name of the network security perimeter profile associated to the resource. |
72+
| **parameters** | List of optional PaaS resource properties in JSON string format. E.g., { {Param1}: {value1}, {Param2}: {value2}, ...}. |
73+
| **appId** | Unique GUID representing the app ID of resource in the Azure Active Directory. |
74+
| **matchedRule** | JSON property bag containing matched accessRule name, {"accessRule" : "{ruleName}"}. It can be either network security perimeter access rule Name or resource rule name (not the ArmId). |
75+
| **source** | JSON property bag describing source of the inbound connection. |
76+
| **destination** | JSON property bag describing destination of the outbound connection. |
77+
| **accessRulesVersion** | JSON property bag containing access rule version of the resource. |
78+
79+
## Source properties
80+
81+
Properties describing source of inbound connection.
82+
83+
| **Value** | **Description** |
84+
| --- | --- |
85+
| **resourceId** | Resource ID of source PaaS resource for an inbound connection. Will exist if applicable. |
86+
| **ipAddress** | IP address of source making inbound connection. Will exist if applicable. |
87+
| **port** | Port number of inbound connection. May not exist for all resource types. |
88+
| **protocol** | Application & transport layer protocols for inbound connection in format {AppProtocol}:{TptProtocol}. E.g., HTTPS:TCP. May not exist for all resource types. |
89+
| **perimeterGuids** | List of perimeter GUIDs of source resource. It should be specified only if allowed based on perimeter GUID. |
90+
| **appId** | Unique GUID representing the app ID of source in the Azure Active Directory. |
91+
| **parameters** | List of optional source properties in JSON string format. E.g., { {Param1}: {value1}, {Param2}: {value2}, ...}. |
92+
93+
## Destination properties
94+
Properties describing destination of outbound connection.
95+
96+
| **Value** | **Description** |
97+
| --- | --- |
98+
| **resourceId** | Resource ID of destination PaaS resource for an outbound connection. Will exist if applicable. |
99+
| **fullyQualifiedDomainName** | Fully Qualified Domain (FQDN) name of the destination. |
100+
| **parameters** | List of optional destination properties in JSON string format. E.g., { {Param1}: {value1}, {Param2}: {value2}, ...}. |
101+
| **port** | Port number of outbound connection. May not exist for all resource types. |
102+
| **protocol** | Application & transport layer protocols for outbound connection in the format {AppProtocol}:{TptProtocol}. E.g., HTTPS:TCP. May not exist for all resource types. |
103+
104+
## Sample log entry For inbound categories
105+
106+
``` json
107+
{
108+
"time" : "{timestamp}",
109+
"timeGeneratedEndTime" : "{timestamp}",
110+
"count" : "{countOfAggregatedLogs}",
111+
"resourceId" : "/SUBSCRIPTIONS/{subsId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYPERIMETERS/{perimeterName}",
112+
"operationName" : "{PaaSOperationName}" ,
113+
"operationVersion" : "{api-version}",
114+
"category" : "{inboundCategory}",
115+
"location" : "{networksecurityperimeterRegion}",
116+
"properties" : {
117+
"serviceResourceId" : "/subscriptions/{paasSubsId}/resourceGroups/{paasResourceGroupName}/providers/{provider}/{resourceType}/{resourceName}",
118+
"serviceFqdn": "{PaaSResourceFQDN}",
119+
"accessRulesVersion" : "{accessRulesVersion}",
120+
"profile" : "{networksecurityperimeterProfileName}",
121+
"appId" : "{resourceAppId}",
122+
"parameters" : "{ {ParameterType1}: {value1}, {ParameterType2}: {value2}, ...}", // Parsable JSON
123+
"matchedRule" : {
124+
"accessRule" : "{matchedRuleName}",
125+
},
126+
"source" : {
127+
"resourceId" : "/subscriptions/{sourceSubscriptionId}/resourceGroups/{sourceResourceGroupName}/providers/{sourceProvider}/{sourceResourceType}/{sourceResourceName}",
128+
"ipAddress": "{sourceIPAddress}",
129+
"perimeterGuids" : ["{sourcePerimeterGuid}"], // Only included if request comes from perimeter
130+
"appId" : "{sourceAppId}",
131+
"port" : "{Port}",
132+
"protocol" : "{Protocol}",
133+
"parameters" : "{ {ParameterType1}: {value1}, {ParameterType2}: {value2}, ...}", // Parsable JSON
134+
},
135+
},
136+
"resultDescription" : "The static text description of this operation on the PaaS resource. For example, \"Get storage file.\""
137+
}
138+
```
139+
140+
## Sample log entry for outbound categories
141+
142+
``` json
143+
{
144+
"time" : "{timestamp}",
145+
"timeGeneratedEndTime" : "{timestamp}",
146+
"count" : "{countOfAggregatedLogs}",
147+
"resourceId" : "/SUBSCRIPTIONS/{subsId}/RESOURCEGROUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYPERIMETERS/{perimeterName}",
148+
"operationName" : "{PaaSOperationName}" ,
149+
"operationVersion" : "{api-version}",
150+
"category" : "{outboundCategory}",
151+
"location" : "{networksecurityperimeterRegion}",
152+
"properties" : {
153+
"serviceResourceId" : "/subscriptions/{paasSubsId}/resourceGroups/{paasResourceGroupName}/providers/{provider}/{resourceType}/{resourceName}",
154+
"serviceFqdn": "{PaaSResourceFQDN}",
155+
"accessRulesVersion" : "{accessRulesVersion}",
156+
"profile" : "{networksecurityperimeterProfileName}",
157+
"appId" : "{resourceAppId}",
158+
"parameters" : "{{ParameterType1}: {value1}, {ParameterType2}: {value2}, ...}", // Parsable JSON
159+
"matchedRule" : {
160+
"accessRule" : "{matchedRuleName}",
161+
},
162+
"destination" : {
163+
"resourceId" : "/subscriptions/{destSubsId}/resourceGroups/{destResourceGroupName}/providers/{destProvider}/{destResourceType}/{destResourceName}",
164+
"fullyQualifiedDomainName" : "{destFQDN}",
165+
"appId" : "{destAppId}",
166+
"port" : "{Port}",
167+
"protocol" : "{Protocol}",
168+
"parameters" : "{ {ParameterType1}: {value1}, {ParameterType2}: {value2}, ...}", // Parsable JSON
169+
},
170+
},
171+
"resultDescription" : "The static text description of this operation on the PaaS resource. For example, \"Get storage file.\""
172+
}
173+
```
174+
42175
## Logging destination options for access logs
43176

44-
The destinations for storing diagnostic logs for a network security perimeter include services like Log Analytic workspace, Azure Storage account, and Azure Event Hubs. For the full list and details of supported destinations, see [Supported destinations for diagnostic logs](/azure/azure-monitor/essentials/diagnostic-settings).
177+
The destinations for storing diagnostic logs for a network security perimeter include services like Log Analytic workspace (**Table name: NSPAccessLogs**), Azure Storage account, and Azure Event Hubs. For the full list and details of supported destinations, see [Supported destinations for diagnostic logs](/azure/azure-monitor/essentials/diagnostic-settings).
45178

46179
## Enable logging through the Azure portal
47180

0 commit comments

Comments
 (0)