You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/network-watcher/traffic-analytics-zero-trust.md
+215-1Lines changed: 215 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,4 +13,218 @@ ms.topic: # Add the ms.topic value
13
13
ms.date: 06/04/2025
14
14
---
15
15
16
-
Apply Zero Trust principles to segment Azure network through traffic analytics
16
+
# Apply Zero Trust principles to segment Azure network through traffic analytics
17
+
18
+
19
+
20
+
Zero Trust is a security strategy. It isn't a product or a service, but an approach in designing and implementing the following set of security principles.
21
+
22
+
|Principle|Description|
23
+
|---|---|
24
+
|Verify explicitly|Always authenticate and authorize based on all available data points.|
25
+
|Use least privilege access|Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection.|
26
+
|Assume breach|Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses.|
27
+
28
+
With Zero Trust, you move away from a trust-by-default perspective to a trust-by-exception one. An integrated capability to automatically manage those exceptions and alerts is important. You can more easily detect threats, respond to threats, and prevent or block undesired events across your organization.
29
+
30
+
Azure’s cloud networking is designed with multiple layers of segmentation that can act as boundaries or trust zones. For more information about segmenting your Azure-based network using Zero Trust principles, see [Apply Zero Trust principles to segmenting Azure-based network communication](/security/zero-trust/azure-networking-segmentation).
31
+
32
+
## Zero Trust Maturity Model
33
+
34
+
The Cybersecurity & Infrastructure Security Agency (CISA) Zero Trust Maturity Model (ZTMM) is built upon five pillars that encompass functions to enhance Zero Trust protection areas. For more information, see [Configure Microsoft cloud services for the CISA Zero Trust Maturity Model](/security/zero-trust/cisa-zero-trust-maturity-model-intro)
35
+
36
+
- Identity
37
+
- Devices
38
+
- Networks
39
+
- Applications and workloads
40
+
- Data
41
+
42
+
The pillars span the ZTMM journey's four stages. For more information, see [ZTMM journey stages](/security/zero-trust/cisa-zero-trust-maturity-model-intro#ztmm-journey-stages).
43
+
44
+
- Traditional
45
+
- Initial
46
+
- Advanced
47
+
- Optimal
48
+
49
+
The four stages apply to the **Networks** pillar as follows:
50
+
51
+
| Stage | Networks pillar |
52
+
| ---- | ---- |
53
+
| Traditional | - Large perimeter / macro-segmentation <br> - Limited resilience and manually managed rulesets and configuration |
54
+
| Initial | - Initial isolation of critical workloads <br> - Network capabilities manage availability demands for more applications <br> - Partial dynamic network configuration |
55
+
| Advanced | - Expand isolation and resilience mechanism <br> - Configurations adapt based on risk-aware application profile assessments |
56
+
| Optimal | - Distribute micro-perimeter with just-in time and just enough access controls and proportionate resilience <br> - Configuration evolves to meet application profile needs |
57
+
58
+
## How can you use traffic analytics to achieve Zero Trust security?
59
+
60
+
Traffic Analytics provides insights into network traffic flows within your Azure environment. It uses virtual network flow logs and performs aggregation to reduce data volume while preserving key traffic patterns. The aggregated logs are then enriched with geographic, security, and topology information and stored in a Log Analytics workspace.
61
+
62
+
Traffic patterns are visualized using built-in dashboards, with flexibility to customize traffic insights using Azure Workbooks. The traffic analytics dashboard also enables you to configure alerts and initiate investigations in response to potential security breaches.
63
+
64
+
-**Monitor network traffic:** Capture inbound and outbound traffic using flow logs, and use traffic analytics to process and visualize this data. Gain insights into communication patterns, bandwidth usage, and traffic flows across workloads.
65
+
66
+
-**Identify workload communication patterns:** Analyze traffic analytics data to understand how resources communicate within and across tenants, subscriptions regions, virtual networks, subnets, protocols, security-based groups, services, and applications. Identify unnecessary or anomalous traffic patterns that could indicate potential security risks.
67
+
68
+
-**Insightful visualizations:** Use built-in and customizable visualizations in traffic analytics to explore traffic patterns and detect anomalies more effectively.
69
+
70
+
-**Detect compromised IPs/resources:** Use traffic analytics to identify potentially compromised IP addresses or resources, helping to strengthen security and maintain performance.
71
+
72
+
The following sections highlight key scenarios where traffic analytics supports micro-segmentation to help implement Zero Trust principles in Azure.
73
+
74
+
## Scenario 1: Detect traffic flowing through risky or restricted regions
75
+
76
+
Use traffic analytics to detect incoming or outgoing traffic to high-risk regions as defined by your organization's policies. For example, you can identify traffic flowing to or from regions considered sensitive or restricted based on your organization’s security and compliance requirements.
77
+
78
+
```kusto
79
+
let ExternalIps = NTAIpDetails
80
+
| where Location in ("country1", "country2")
81
+
| where FlowType in ("MaliciousFlow", "ExternalPublic")
82
+
//and FlowIntervalStartTime between (datetime('{timeInterval') .. datetime('{timeInterval'))
| summarize count() by SrcExternalIp ,DestCompromisedIp, CompromisedVM,
123
+
PublicIpDetails,
124
+
FlowType,
125
+
ThreatType,
126
+
DnsDomain,
127
+
ThreatDescription,
128
+
Location,
129
+
Url
130
+
```
131
+
132
+
## Scenario 2: Achieve traffic segmentation based on Azure service interactions
133
+
134
+
Use traffic analytics to gain a bird's-eye view of how different workloads interact with Azure services. For example, SAP workloads might communicate with Azure Arc infrastructure, while other workloads, such as development environments or productivity services, interact with Azure Monitor. These insights help you understand service dependencies, detect unexpected or anomalous traffic patterns, and enforce more granular security policies through micro-segmentation.
135
+
136
+
```kusto
137
+
let SpecificServices = NTAIpDetails
138
+
| where FlowType == "AzurePublic"
139
+
| where FlowIntervalStartTime > ago(4h)
140
+
| project Ip, PublicIpDetails;
141
+
let PublicIPs = NTANetAnalytics
142
+
| where SubType == 'FlowLog'
143
+
| where FlowIntervalStartTime > ago(4h)
144
+
| where(isnotempty(SrcPublicIps) or isnotempty(DestPublicIps))
| mv-expand ExtractedIPs // Expand into multiple rows
148
+
| extend IP = tostring(split(ExtractedIPs, "|")[0]) // Extract IP address
149
+
| lookup kind=inner SpecificServices on $left.IP == $right.Ip
150
+
| project Vnet, PublicIpDetails;
151
+
PublicIPs
152
+
| summarize CounterValue = count() by Vnet, PublicIpDetails
153
+
| top 100 by CounterValue desc
154
+
```
155
+
156
+
## Scenario 3: Identify blast radius in case of network breach
157
+
158
+
Use traffic analytics to trace the path of potentially malicious IP addresses attempting to communicate with your resources. In the event of a compromised virtual machine (VM), traffic analytics can help map all communications initiated by that VM over the past 24 hours, aiding in identifying potential data exfiltration and limiting the blast radius.
159
+
160
+
The following query identifies all direct and indirect IP addresses interacting with malicious flows from high-risk geographies:
161
+
162
+
```kusto
163
+
let MAliciousIps = NTAIpDetails
164
+
| where FlowIntervalStartTime between (datetime('{timeInterval:startISO}') .. datetime('{timeInterval:endISO}'))
165
+
| where FlowType == "MaliciousFlow"
166
+
| distinct Ip;
167
+
let MaliciousFlows = NTANetAnalytics
168
+
| where FlowStartTime between (todatetime('{timeInterval:startISO}') .. todatetime('{timeInterval:endISO}'))
169
+
| where SubType == "FlowLog" and FlowType == "MaliciousFlow"
Use traffic analytics to enforce subscription boundaries and ensure that traffic between different Azure subscriptions is properly segmented.
215
+
216
+
```kusto
217
+
NTANetAnalytics
218
+
| where SubType == "FlowLog" and FlowType !in ("AzurePublic","ExternalPublic","Unknown","UnknownPrivate") // Filter to flows for which we know the Subscription Details
219
+
| where FlowStartTime between (start .. end)
220
+
| where AclGroup !contains "Unspecified"
221
+
|extend Dest = iff(isnotempty(DestSubnet),strcat("/subscriptions/",DestSubscription,"/resourceGroups/",tostring(split(DestSubnet,"/")[0]),"/providers/Microsoft.Network/virtualNetworks/",tostring(split(DestSubnet,"/")[1])),'')
0 commit comments