Skip to main content
Version: 2.10.0

Azure NSG Flow Logs (10401 / 20401)

Description​

This Module reports NSG Flow Logs ingested from Azure clooud translating them one-to-one in syslog or JSON formats, and enriching them with Azure data not reported in NSG Flow Logs natively.

Parameters​

Parameter NameDescriptionComments
Azure VM InstancesVMs with IPv4, IPv6, Subscription ID, Subscription Name, VM Name, NSG Name, Virtual Network Name, etcProvided by EDF agent
Azure IPv4 RoutesIP range, source and destination Virtual Network hashProvided by EDF agent
Azure IPv6 RoutesIP range, source and destination Virtual Network hashProvided by EDF agent
Azure IPv4 RangesIPv4 ranges, Service name, RegionProvided by EDF agent
Azure IPv6 RangesIPv6 ranges, Service name, RegionProvided by EDF agent

Input​

Azure NSG Flow Logs

Syslog/JSON Message Fields​

KeyField DescriptionComments
nfc_idMessage type identifier“nfc_id=20401”
exp_ipExporter Ipv4 address<IPv4 address> (added for compatibility with other flows)
protocolTransport Protocol (TCP = 6, UDP = 17)<number>
directionThe direction of the traffic flow<string>
decisionWhether traffic was allowed or denied<string>, valid values are “A” for allowed and “D” for denied
stateState of the flow<string>, possible states are “B”: Begin, “C”: Continuing, “E”: End
src_ipSource VM instance IPv4 address<IPv4 address>
[src_ip6]Source VM instance Ipv6 address<IPv6 address>
[src_host]Source host name<string>, included when FQDN is on
[src_subs_id]Source Subscription ID<string>
[src_subs_name]Source Subscription Name<string>
[src_vm_name]Source VM name<string>
[src_nsg_name]Source NSG name<string>
[src_vnet_name]Source Virtual Network name<string>
[src_subnetwork_name]Source Subnet name<string>
[src_region]Source Region<string>
[src_res_grp_name]Source Resource Group Name<string>
src_portSource port number<number>
dest_ipDestination VM instance IPv4 address<IPv4 address>
[dest_ip6]Destination VM instance Ipv6 address<IPv6 address>
[dest_host]Destination host name<string>, included when FQDN is on
[dest_subs_id]Destination Subscription ID<string>
[dest_subs_name]Destination Subscription Name<string>
[dest_vm_name]Destination VM name<string>
[dest_nsg_name]Destination NSG name<string>
[dest_vnet_name]Destination Virtual Network name<string>
[dest_subnetwork_name]Destination Subnet name<string>
[dest_region]Destination Region<string>
[dest_res_grp_name]Destination Resource Group Name<string>
dest_portDestination port number<number>
packets_inTotal number of packets in the consolidated flows from the source to the destination<number>
bytes_inTotal number of Layer 3 bytes in the packets of the consolidated flows from the source to the destination<number>
packets_outTotal number of packets in the consolidated flows from the destination to the source<number>
bytes_outTotal number of Layer 3 bytes in the packets of the consolidated flows from the destination to the source<number>
flow_timeThis value is the time stamp of when the flow occurred<time>