Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Network Security Group Flow Logs Analyzer #23

Open
lucky-luk3 opened this issue Jan 10, 2022 · 1 comment
Open

Network Security Group Flow Logs Analyzer #23

lucky-luk3 opened this issue Jan 10, 2022 · 1 comment
Labels
enhancement New feature or request

Comments

@lucky-luk3
Copy link

Is your feature request related to a problem? Please describe.
The Network Security Group Flow Logs analysis tool is not very advanced and comfortable. I think it would be very useful to have a functionality to read and analyze NSG Flog logs directly from the Azure Storage Account, being able to carry out the advanced analyzes already existing in the library, as well as the existing data enrichment mechanisms.
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

Describe the solution you'd like
I propose an object to research NGS FLow Logs stored in a BlobStorage. This object could have some funtions:

  • Azure data summary (read data in blobstorage and create a summary, given the possibility to filter out non-relevant data)
  • Download data from blobstorage, having the possibilitie to download all data in all blobs that fit in datetime filter or content filter and creating a result DataFrame.
  • Perform data analysis with graphs or statistical analisys.

Describe alternatives you've considered
I have developed a notebook that performs these actions more or less. The code is not very sophisticated (it is only a first approach).

Additional context
https://github.com/lucky-luk3/Infosec_Notebooks/blob/main/NGS_Log_Analysis-Public.ipynb
image
image

@petebryan
Copy link
Contributor

Love it! Thanks @lucky-luk3

@petebryan petebryan added the enhancement New feature or request label Jan 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants