Azure NSG Flow Logs Setup

This document provides instructions for configuring the collection of Azure Network Security Group (NSG) Flow Logs.

The 3 methods covered are:

Requirements

Before you begin configuring NSG Flow Log collection, make sure the following environment prerequisites are met:

Your Storage Account must be of type General-purpose v2 or Blob storage.
Your Network Security Group and Storage Account should be in the same region.
NSG Flow Logs do not work with storage accounts that have hierarchical namespace enabled.

NSG flow logging requires the Microsoft.Insights provider. To register the provider, complete the following steps:

In the top, left corner of the portal, select All services. In the Filter box, type Subscriptions. When Subscriptions appear in the search results, select it.
From the list of subscriptions, select the subscription you want to enable the provider for.
Select Resource providers, under Settings.
Confirm that the Status for the microsoft.insights provider is Registered, as shown in the picture that follows. If the status is Unregistered, then select Register, at the top of the table.

In the top, left corner of the portal, select All services. In the Filter box, type Network security groups. When Network security groups appear in the search results, select it.
On the Network security groups window that appears, choose Create.
Select the subscription in which to create the storage account.
Under the Resource group field, select the resource group that you want to create the NSG on.
Next, enter a name for your network security group. The name you choose must be unique across Azure.
Select a region for your network security group to match the resource group
Select Review + Create to review your network security group settings and create the nsg.
Select Create.

To create a general-purpose v2 storage account in the Azure portal, follow these steps:

On the Azure portal menu, select All services. In the list of resources, type Storage Accounts. As you begin typing, the list filters based on your input. Select Storage Accounts.
On the Storage Accounts window that appears, choose Add.
Select the subscription in which to create the storage account.
Under the Resource group field, select the resource group that you want to create storage on.
Next, enter a name for your storage account. The name you choose must be unique across Azure. The name also must be between 3 and 24 characters in length, and can include numbers and lowercase letters only.
Select a location for your storage account.
Leave these fields set to their default values:


Deployment mode	Resource Manager
Performance	Standard
Account kind	StorageV2 (general-purpose v2)
Redundancy	Read-access geo-redundant storage (RA-GRS)
Access tier	Hot

Select Review + Create to review your storage account settings and create the account.
Select Create.

In the portal, select All services. In the Filter box, enter Network Watcher. When Network Watcher appears in the results, select it.
Select Regions, to expand it, and then select ... to the right of your desired region.
Select Enable Network Watcher.

In the top, left corner of the portal, select All services. In the Filter box, type Network Watcher. When Network Watcher appears in the search results, select it.
Under Logs, select Flow logs
From the list of NSGs, select the NSG you created in step 2.
Under Flow logs settings, select On.
Select the Flow Logs Version. Version 2 contains flow-session statistics (Bytes and Packets)
Select the storage account that you created in step 3.
Set Retention (days) to 1, and then select Save.

Navigate to Flow Sources, and click "Add Flow Source", then select Azure NSG

The following fields are specific to the Azure configuration.

Field	Required	Description
`Region`	yes	Location of the flow source
`Container Name`	yes	Storage Account's Container Name
`Subscription ID`	yes	Network Security Group's subscription ID
`Resource Group`	yes	Network Security Group's Resource Group
`Network Security Group`	yes	Network Security Group's Name

The following fields are necessary for the integration to authenticate with Azure NSG.

`Account Name`	yes	The account name to use for this stream
`Account Name`	yes	The Storage Account's Access Name to use for this stream
`Account Key`	yes	Storage Account's Access Key for authenticating to this stream