Azure Network Security Group Open to the World
Set up the azure integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when an Azure network security group allows inbound traffic from all IP Addresses.
Strategy
This rule monitors Azure Activity logs for network changes and detects when the @evt.name has a value of MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE, @properties.securityRules.properties.direction has a value of Inbound, @properties.securityRules.properties.access has a value of Allow, and @properties.securityRules.properties.sourceAddressPrefix has a value of either 0.0.0.0/0 OR *.
Triage and response
- Inspect which Virtual Machines are associated with this security group.
- Determine whether this security group and the VMs should permit inbound traffic from all IP addresses.
