dfir.chwriteupToday I Learned - NSG Flow Log
A short DFIR.ch "Today I Learned" post walking through enabling Azure NSG Flow Logs (v2), storing them in a Storage Account, and parsing the flowTuple JSON schema (timestamp, src/dst IP/port, protocol, direction, allow/deny, flow state B/C/E). It highlights use cases like detecting RDP brute-force attempts and integrating logs into Sentinel/Splunk/ELK for network monitoring and incident response.
TL;DR Quick primer on setting up and reading Azure NSG Flow Logs for network traffic auditing and DFIR.
Organisations named here
- DefaultRule_AllowInternetOutBound
- DefaultRule_DenyAllInBound
- UserRule_RDP
Technologies named here
- Azure NSG Flow Logs
- Azure Network Security Group
- Azure Storage Account
- Azure Monitor
- Azure Virtual Network Interface
- Azure Storage
- SIEM
- Microsoft Sentinel
- Splunk
- ELK stack
- Azure
- Elastic Stack
Techniques named here
- Network traffic flow logging and analysis
- Detecting unusual traffic and lateral movement
Related in Cloud & Infra
orca.securityarticleOrca Security: GenAI Risks in Cloud Environments
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
attackthesoc.comarticle