Skip to content

Commit 8920f9a

Browse files
committed
Required for a clean commit
1 parent cb36a3f commit 8920f9a

File tree

2 files changed

+13
-12
lines changed

2 files changed

+13
-12
lines changed

.vscode/settings.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,5 +57,6 @@
5757
],
5858
"cSpell.words": [
5959
"auditd"
60-
]
60+
],
61+
"git.ignoreLimitWarning": true
6162
}

articles/security-center/security-center-adaptive-network-hardening.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Applying [network security groups (NSG)](https://docs.microsoft.com/azure/virtua
2323

2424
Adaptive Network Hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.
2525

26-
For example, lets say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardenings recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
26+
For example, let's say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardening's recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
2727

2828
![network hardening view](./media/security-center-adaptive-network-hardening/traffic-hardening.png)
2929

@@ -38,7 +38,7 @@ For example, let’s say the existing NSG rule is to allow traffic from 140.20.3
3838
* **Unscanned resources**: VMs that the Adaptive Network Hardening algorithm cannot be run on because of one of the following reasons:
3939
* **VMs are Classic VMs**: Only Azure Resource Manager VMs are supported.
4040
* **Not enough data is available**: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.
41-
* **VM is not protected by ASC standard**: Only VMs that are set to Security Centers Standard pricing tier are eligible for this feature.
41+
* **VM is not protected by ASC standard**: Only VMs that are set to Security Center's Standard pricing tier are eligible for this feature.
4242

4343
![unhealthy resources](./media/security-center-adaptive-network-hardening/unhealthy-resources.png)
4444

@@ -74,19 +74,19 @@ You may want to modify the parameters of a rule that has been recommended. For e
7474

7575
Some important guidelines for modifying an Adaptive Network Hardening rule:
7676

77-
* You can modify the parameters of allow rules only.
78-
* You cannot change allow rules to become deny rules.
77+
* You can modify the parameters of "allow" rules only.
78+
* You cannot change "allow" rules to become "deny" rules.
7979

8080
> [!NOTE]
81-
> Creating and modifying deny rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
81+
> Creating and modifying "deny" rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
8282
83-
* A **Deny all traffic** rule is the only type of deny rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
83+
* A **Deny all traffic** rule is the only type of "deny" rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
8484
> [!NOTE]
85-
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as *System Generated*. After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, DENY, and a random number.
85+
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as "*System Generated*". After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, "DENY", and a random number.
8686
8787
*To modify an Adaptive Network Hardening rule:*
8888

89-
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rules row, and click **Edit**.
89+
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Edit**.
9090

9191
![edit rule](./media/security-center-adaptive-network-hardening/edit-hard-rule.png)
9292

@@ -103,10 +103,10 @@ Some important guidelines for modifying an Adaptive Network Hardening rule:
103103

104104
### Add a new rule <a name ="add-rule"> </a>
105105

106-
You can add an allow rule that was not recommended by Security Center.
106+
You can add an "allow" rule that was not recommended by Security Center.
107107

108108
> [!NOTE]
109-
> Only allow rules can be added here. If you want to add deny rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
109+
> Only "allow" rules can be added here. If you want to add "deny" rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
110110
111111
*To add an Adaptive Network Hardening rule:*
112112

@@ -130,7 +130,7 @@ When necessary, you can delete a recommended rule for the current session. For e
130130

131131
*To delete an Adaptive Network Hardening rule for your current session:*
132132

133-
1. In the **Rules** tab, click on the three dots (...) at the end of the rules row, and click **Delete**.
133+
1. In the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Delete**.
134134

135135
![hardening rules](./media/security-center-adaptive-network-hardening/delete-hard-rule.png)
136136

0 commit comments

Comments
 (0)