[ 1 Connect Microsoft Azure NSG Flow Logs with LogicHub ] [ 2 Actions for Microsoft Azure NSG Flow Logs ] [ 2.1 Get Logs ] [ 2.1.1 Input Field ] [ 2.1.2 Output ] [ 3 Release Notes ]

NSG flow logs are stored in a storage account in block blobs. Block blobs are made up of smaller blocks. Each log is a separate block blob that is generated every hour. New logs are generated every hour, the logs are updated with new entries every few minutes with the latest data.

Connect Microsoft Azure NSG Flow Logs with LogicHub

Navigate to Automations > Integrations.
Search for Microsoft Azure NSG Flow Logs.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the LogicHub Remote Agent.
Storage Account Name: Storage Account name in which logs are stored.
Storage Account Access Key: Access Key required for authentication to Microsoft Azure Storage account
After you've entered all the details, click Connect.

Actions for Microsoft Azure NSG Flow Logs

Get Logs

Fetch Flow log tuples of Azure NSG Flow. Blocks are generated per minute. So query on larger time range will carry more number of requests(one request per minute of time range). As an example one hour range will hit Azure servers 60 times to fetch all data which are divided into 60 files (and would be quite slow)

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Resource Group	Resource group to which Storage account is linked.	Required
NSG Name	NSG name for which logs are to be retrieved.	Required
Mac Address	Jinja-templated Mac address for which logs are to be retrieved.
Example: 000D3AF65286.	Required
Start Time	Start time in ISO format for logs to be retrieved. Example: 2019-09-26T07:58:30.996+02:00. Default is execution start time.	Required
End Time	End time in ISO format for logs to be retrieved. Example: 2019-09-26T07:58:30.996+02:00. Default is execution end time.	Required

Output

An Array of JSON in individual rows with each containing the following items:

has_error: True/False
error: message/null
result: flow log tuple

{json}{ "error":null, "has_error":false, "result":"1620057588,10.0.0.4,20.150.87.132,48486,443,T,O,A,E,0,0,0,0" }

Release Notes

v2.0.0 - Updated architecture to support IO via filesystem