You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/security-center/security-center-adaptive-network-hardening.md
+86-22Lines changed: 86 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Adaptive Network Hardening in Azure Security Center | Microsoft Docs
3
-
description: Learn how to harden, based on actual traffic patterns, your network security groups (NSG) rules and further improve your security posture.
3
+
description: Learn how to use actual traffic patterns to harden your network security groups (NSG) rules and further improve your security posture.
4
4
services: security-center
5
5
documentationcenter: na
6
6
author: memildin
@@ -12,9 +12,10 @@ ms.devlang: na
12
12
ms.topic: conceptual
13
13
ms.tgt_pltfrm: na
14
14
ms.workload: na
15
-
ms.date: 05/24/2019
15
+
ms.date: 03/11/2020
16
16
ms.author: memildin
17
17
---
18
+
18
19
# Adaptive Network Hardening in Azure Security Center
19
20
Learn how to configure Adaptive Network Hardening in Azure Security Center.
20
21
@@ -23,12 +24,14 @@ Applying [network security groups (NSG)](https://docs.microsoft.com/azure/virtua
23
24
24
25
Adaptive Network Hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.
25
26
26
-
For example, let’s say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardening’s recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
27
+
For example, let's say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. The Adaptive Network Hardening's recommendation, based on the analysis, would be to narrow the range and allow traffic from 140.23.30.10/29 – which is a narrower IP range, and deny all other traffic to that port.
> Adaptive Network Hardening recommendations are only supported on specific ports. For the full list, see [#which-ports-are-supported](Which ports are supported?) below.
> Adaptive Network Hardening recommendations are supported on the following ports: 22, 3389, 21, 23, 445, 4333, 3306, 1433, 1434, 53, 20, 5985, 5986, 5432, 139, 66, 1128
32
35
33
36
## View Adaptive Network Hardening alerts and rules
34
37
@@ -38,7 +41,7 @@ For example, let’s say the existing NSG rule is to allow traffic from 140.20.3
38
41
***Unscanned resources**: VMs that the Adaptive Network Hardening algorithm cannot be run on because of one of the following reasons:
39
42
***VMs are Classic VMs**: Only Azure Resource Manager VMs are supported.
40
43
***Not enough data is available**: In order to generate accurate traffic hardening recommendations, Security Center requires at least 30 days of traffic data.
41
-
***VM is not protected by ASC standard**: Only VMs that are set to Security Center’s Standard pricing tier are eligible for this feature.
44
+
***VM is not protected by ASC standard**: Only VMs that are set to Security Center's Standard pricing tier are eligible for this feature.
@@ -74,19 +77,19 @@ You may want to modify the parameters of a rule that has been recommended. For e
74
77
75
78
Some important guidelines for modifying an Adaptive Network Hardening rule:
76
79
77
-
* You can modify the parameters of “allow” rules only.
78
-
* You cannot change “allow” rules to become “deny” rules.
80
+
* You can modify the parameters of "allow" rules only.
81
+
* You cannot change "allow" rules to become "deny" rules.
79
82
80
83
> [!NOTE]
81
-
> Creating and modifying “deny” rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
84
+
> Creating and modifying "deny" rules is done directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
82
85
83
-
* A **Deny all traffic** rule is the only type of “deny” rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
86
+
* A **Deny all traffic** rule is the only type of "deny" rule that would be listed here, and it cannot be modified. You can, however, delete it (see [Delete a rule](#delete-rule)).
84
87
> [!NOTE]
85
-
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as “*System Generated*”. After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, “DENY”, and a random number.
88
+
> A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Security Center does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as "*System Generated*". After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, "DENY", and a random number.
86
89
87
90
*To modify an Adaptive Network Hardening rule:*
88
91
89
-
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rule’s row, and click **Edit**.
92
+
1. To modify some of the parameters of a rule, in the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Edit**.
@@ -103,10 +106,10 @@ Some important guidelines for modifying an Adaptive Network Hardening rule:
103
106
104
107
### Add a new rule <aname ="add-rule"> </a>
105
108
106
-
You can add an “allow” rule that was not recommended by Security Center.
109
+
You can add an "allow" rule that was not recommended by Security Center.
107
110
108
111
> [!NOTE]
109
-
> Only “allow” rules can be added here. If you want to add “deny” rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
112
+
> Only "allow" rules can be added here. If you want to add "deny" rules, you can do so directly on the NSG. For more information, see [Create, change, or delete a network security group](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group).
110
113
111
114
*To add an Adaptive Network Hardening rule:*
112
115
@@ -130,15 +133,76 @@ When necessary, you can delete a recommended rule for the current session. For e
130
133
131
134
*To delete an Adaptive Network Hardening rule for your current session:*
132
135
133
-
1. In the **Rules** tab, click on the three dots (...) at the end of the rule’s row, and click **Delete**.
136
+
1. In the **Rules** tab, click on the three dots (...) at the end of the rule's row, and click **Delete**.
0 commit comments