Skip to main content
Version: 2.10.1

Azure Top Traffic Monitor (10467 / 20467)

Description

This Module identifies Azure VMs with the most traffic. It consolidates NSG Flow Logs records over a period of time (Data Collection Interval) which all have the same combination of the following fields:

  • Source IP address
  • Destination IP address
  • Source port number
  • Destination port number
  • Layer 3 protocol

This information is provided per Virtual Network (Exporter). The Module also enriches them with Azure data not reported in NSG Flow Logs natively.

De-duplication: optionally the Module can report consolidated flows only from authoritative Virtual Network. Authoritative NSG is determined as follows. The Module sums up bytes, packets, and connections between two communicating peers over data collection interval reported by each Virtual Network. A Virtual Network with most connections (flows) for each consolidated flow is considered authoritative, and flows reported for the same two peers by all other Virtual Networks are discarded.

Parameters

Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 5 sec, max = 1800 sec, default = 30 sec
N – number of reported hostsThe number of top hosts reported per Virtual Networkmin = 0, max = 100000, default = 50 (0 indicates all hosts are reported)
Share of total traffic reported, %Reported percent of total traffic per Virtual Networke.g. 98 - indicates that reported consolidated flows consuming 98% of total NetFlow exporter traffic; min = 1%, max = 100%, default = 95%. Not more than N consolidated flows will be reported
Enable(1) or disable (0) reporting by authoritative exporters onlyIf set to 1 (de-duplication enabled), the Module reports flows only from authoritative Virtual Networks (exporters)default = 0
Azure VM InstancesVMs with IPv4, IPv6, Subscription ID, Subscription Name, VM Name, NSG Name, Virtual Network Name, etcProvided by EDF agent
Azure IPv4 RoutesIP range, source and destination Virtual Network hashProvided by EDF agent
Azure IPv6 RoutesIP range, source and destination Virtual Network hashProvided by EDF agent
Azure IPv4 RangesIPv4 ranges, Service name, RegionProvided by EDF agent
Azure IPv6 RangesIPv6 ranges, Service name, RegionProvided by EDF agent

Input

Azure NSG Flow Logs

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20467”
exp_ipExporter Ipv4 addressIPv4 address (added for compatibility with other flows)
protocolTransport Protocol (TCP = 6, UDP = 17)number
directionThe direction of the traffic flowstring
decisionWhether traffic was allowed or deniedstring, valid values are “A” for allowed and “D” for denied
src_ipSource VM instance IPv4 addressIPv4 address
[src_ip6]Source VM instance Ipv6 addressIPv6 address
[src_host]Source host namestring, included when FQDN is on
[src_subs_id]Source Subscription IDstring
[src_subs_name]Source Subscription Namestring
[src_vm_name]Source VM namestring
[src_nsg_name]Source NSG namestring
[src_vnet_name]Source Virtual Network namestring
[src_subnetwork_name]Source Subnet namestring
[src_service]Source Servicestring
[src_region]Source Regionstring
[src_res_grp_name]Source Resource Group Namestring
src_portSource port numbernumber
dest_ipDestination VM instance IPv4 addressIPv4 address
[dest_ip6]Destination VM instance Ipv6 addressIPv6 address
[dest_host]Destination host namestring, included when FQDN is on
[dest_subs_id]Destination Subscription IDstring
[dest_subs_name]Destination Subscription Namestring
[dest_vm_name]Destination VM namestring
[dest_nsg_name]Destination NSG namestring
[dest_vnet_name]Destination Virtual Network namestring
[dest_subnetwork_name]Destination Subnet namestring
[dest_service]Destination Servicestring
[dest_region]Destination Regionstring
[dest_res_grp_name]Destination Resource Group Namestring
dest_portDestination port numbernumber
packets_inTotal number of packets in the consolidated flows from the source to the destinationnumber
bytes_inTotal number of Layer 3 bytes in the packets of the consolidated flows from the source to the destinationnumber
packets_outTotal number of packets in the consolidated flows from the destination to the sourcenumber
bytes_outTotal number of Layer 3 bytes in the packets of the consolidated flows from the destination to the sourcenumber
flow_countNumber of consolidated flowsnumber
percent_of_totalPercent of Total (bytes)decimal, e.g. 25.444% is 25.444
flow_start_timeStart time of the first consolidated flowtime
flow_end_timeEnd of the last consolidated flowtime
t_intObservation time interval, msecnumber