{"id":5390,"date":"2021-10-22T17:09:49","date_gmt":"2021-10-22T08:09:49","guid":{"rendered":"https:\/\/www.syuheiuda.com\/?p=5390"},"modified":"2022-08-03T19:05:27","modified_gmt":"2022-08-03T10:05:27","slug":"nsg-flow-log-%e3%82%92-azure-powershell-%e3%81%a7%e6%89%b1%e3%81%84%e3%81%9f%e3%81%84","status":"publish","type":"post","link":"https:\/\/www.syuheiuda.com\/?p=5390","title":{"rendered":"NSG Flow Log \u3092 Azure PowerShell \u3067\u6271\u3044\u305f\u3044"},"content":{"rendered":"\n<p>NSG Flow Log \u3092 Azure Storage \u306b\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u304a\u3044\u3066\u3082\u3001JSON \u306e\u307e\u307e\u3060\u3068\u89e3\u6790\u304c\u96e3\u3057\u3044\u306e\u3067 Tuple (IP \/ Port, etc&#8230;) \u3060\u3051\u7c21\u5358\u306b\u62bd\u51fa\u3067\u304d\u308b PowerShell \u3092\u66f8\u3044\u3066\u307f\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p>Traffic Analytics \u3092\u6709\u52b9\u5316\u3057\u3066 Log Analytics \u3067 Kusto \u30af\u30a8\u30ea\u3092\u4f7f\u3046\u65b9\u304c\u304a\u3059\u3059\u3081\u3067\u3059\u304c\u3001\u6709\u52b9\u5316\u3057\u5fd8\u308c\u3066\u3066 JSON \u3092\u751f\u3067\u898b\u308b\u3057\u304b\u7121\u3044\u6642\u306a\u3069\u3067\u4f7f\u3063\u3066\u307f\u3066\u304f\u3060\u3055\u3044\u3002\u30ed\u30b0\u306e\u91cf\u304c\u591a\u3044\u3068\u975e\u5e38\u306b\u6642\u9593\u304c\u304b\u304b\u308b\u306e\u3067\u3001\u9069\u5f53\u306b\u6761\u4ef6\u8ffd\u52a0\u3057\u3066\u30d5\u30a3\u30eb\u30bf\u30fc\u3057\u305f\u308a\u3057\u3066\u3044\u305f\u3060\u3051\u308c\u3070\u3068\u3002<\/p>\n\n\n\n<p><pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\n# \u5404\u7a2e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc (\u8981\u5909\u66f4)\n$ResourceGroupName = &quot;RG-Name&quot;\n$StorageName = &quot;StrName&quot;\n$LogPath = &quot;C:\\Users\\UserName\\Desktop\\NsgFlowLog\\&quot;    # \u4f5c\u6210\u6e08\u307f\u306e\u30d5\u30a9\u30eb\u30c0\u3092\u6307\u5b9a\u3001\u672b\u5c3e\u306b \\ \u304c\u5fc5\u8981\n$ResultPath = &quot;C:\\Users\\UserName\\Desktop\\NsgFlowLog\\&quot;     # \u540c\u4e0a\n\n# Azure Storage \u3078\u306e\u30a2\u30af\u30bb\u30b9\u7528\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u53d6\u5f97\n$StorageAccount = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageName\n$Context = $StorageAccount.Context\n\n# Blob \u304b\u3089 NSG \u30d5\u30ed\u30fc \u30ed\u30b0\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\nGet-AzStorageBlob -Container &quot;insights-logs-networksecuritygroupflowevent&quot; -Context $Context | Get-AzStorageBlobContent -Destination $LogPath\n\n# \u30d5\u30a1\u30a4\u30eb\u4e00\u89a7\u3092\u53d6\u5f97\n$FileList = Get-ChildItem -Path $LogPath -include *.json -Recurse -Force \n\n# NSG \u30d5\u30ed\u30fc\u30ed\u30b0\u304b\u3089 flowTuples \u306e\u307f\u3092\u62bd\u51fa\n$Records = @(&quot;Time Stamp,Source IP,Destination IP,Source Port,Destination Port,Protocol,Traffic Flow,Traffic Decision,Flow State,Packets - Source to destination,Bytes sent - Source to destination,Packets - Destination to source,Bytes sent - Destination to source&quot;)\n$Records += $FileList | foreach {(Get-Content -Path $_.FullName | ConvertFrom-Json).records.properties.flows.flows.flowtuples}\n\n# \u5168\u3066\u306e\u30ec\u30b3\u30fc\u30c9\u3092\u62bd\u51fa\u3057\u3066 CSV \u30d5\u30a1\u30a4\u30eb\u3092\u751f\u6210\n$Records | Out-File &quot;$ResultPath\\AllRecords.csv&quot; -Encoding utf8\n\n# \u7279\u5b9a\u306e\u6761\u4ef6\u3092\u6e80\u305f\u3059\u30ec\u30b3\u30fc\u30c9\u3092\u62bd\u51fa\u3057\u3066 CSV \u30d5\u30a1\u30a4\u30eb\u3092\u751f\u6210 (&quot;O,D&quot; \u3059\u306a\u308f\u3061 Outbound \u3067 Deny \u3055\u308c\u305f\u3082\u306e\u3060\u3051\u62bd\u51fa\u3059\u308b\u5834\u5408)\n$Records | Select-String &quot;O,D&quot; | Out-File &quot;$ResultPath\\FilteredRecords.csv&quot; -Encoding utf8\n\n# \u7279\u5b9a\u306e\u6761\u4ef6\u3092\u6e80\u305f\u3059\u30ec\u30b3\u30fc\u30c9\u3092\u62bd\u51fa\u3057\u3066\u753b\u9762\u8868\u793a\n$CSV = ($Records | ConvertFrom-Csv)\n$CSV | where {$_.&quot;Destination Port&quot; -eq 443 -and $_.&quot;Traffic Flow&quot; -eq &quot;O&quot;} | Format-Table\n<\/pre> <\/p>\n\n\n\n<p>\u306a\u304a\u3001NSG Flow Log \u306e\u30ed\u30b0 \u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u306b\u3064\u3044\u3066\u306f\u3001\u4ee5\u4e0b\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u8a18\u8f09\u304c\u3042\u308a\u307e\u3059\u3002TCP \u306f &#8220;T&#8221;\u3001UDP \u306f &#8220;U&#8221;\u3001Inbound \u306f &#8220;I&#8221;\u3001Outbound \u306f &#8220;O&#8221;\u3001Allow \u306f &#8220;A&#8221;\u3001Deny \u306f &#8220;D&#8221; \u3068\u3044\u3063\u305f\u611f\u3058\u306a\u306e\u3067\u3001\u7279\u306b\u96e3\u3057\u304f\u306f\u7121\u3044\u3068\u601d\u3044\u307e\u3059\u304c\u3001\u30d5\u30a3\u30eb\u30bf\u30fc\u3059\u308b\u6587\u5b57\u5217\u306f\u30ed\u30b0 \u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u3092\u8aad\u307f\u3064\u3064\u3044\u3058\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<ul><li>\u30ed\u30b0\u306e\u5f62\u5f0f<br><a href=\"https:\/\/docs.microsoft.com\/ja-jp\/azure\/network-watcher\/network-watcher-nsg-flow-logging-overview#log-format\">https:\/\/docs.microsoft.com\/ja-jp\/azure\/network-watcher\/network-watcher-nsg-flow-logging-overview#log-format<\/a><\/li><\/ul>\n\n\n\n<p class=\"has-text-color has-luminous-vivid-orange-color\"><strong>\u203b Windows \u3067\u306f\u30d5\u30a1\u30a4\u30eb \u30d1\u30b9\u304c 260 \u6587\u5b57\u306e\u5236\u7d04\u304c\u3042\u308b\u306e\u3067\u3001\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9 \u30d5\u30a9\u30eb\u30c0\u306f C \u30c9\u30e9\u30a4\u30d6\u76f4\u4e0b\u306a\u3069\u306b\u3059\u308b\u4e8b\u3092\u63a8\u5968\u3057\u307e\u3059\u3002<\/strong><\/p>\n\n\n\n<ul><li>\u30d1\u30b9\u306e\u6700\u5927\u9577\u306e\u5236\u9650<br><a href=\"https:\/\/docs.microsoft.com\/ja-jp\/windows\/win32\/fileio\/maximum-file-path-limitation?tabs=cmd\">https:\/\/docs.microsoft.com\/ja-jp\/windows\/win32\/fileio\/maximum-file-path-limitation?tabs=cmd<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>NSG Flow Log \u3092 Azure Storage \u306b\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u304a\u3044&hellip;<\/p>\n<p class=\"more-link-p\"><a class=\"more-link\" href=\"https:\/\/www.syuheiuda.com\/?p=5390\">Read more &rarr;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_locale":"","_original_post":""},"categories":[39,31],"tags":[],"views":7366,"_links":{"self":[{"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/posts\/5390"}],"collection":[{"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5390"}],"version-history":[{"count":5,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/posts\/5390\/revisions"}],"predecessor-version":[{"id":5402,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=\/wp\/v2\/posts\/5390\/revisions\/5402"}],"wp:attachment":[{"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.syuheiuda.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}