Analyze your Virtual Machine security with Security Group View using Azure CLI
Note
The Security Group View API is no longer being maintained and will be deprecated soon. Please use the Effective Security Rules feature which provides the same functionality.
Security group view returns configured and effective network security rules that are applied to a virtual machine. This capability is useful to audit and diagnose Network Security Groups and rules that are configured on a VM to ensure traffic is being correctly allowed or denied. In this article, we show you how to retrieve the configured and effective security rules to a virtual machine using Azure CLI
To perform the steps in this article, you need to install the Azure CLI for Windows, Linux, or macOS.
Before you begin
This scenario assumes you have already followed the steps in Create a Network Watcher to create a Network Watcher.
Scenario
The scenario covered in this article retrieves the configured and effective security rules for a given virtual machine.
Get a VM
A virtual machine is required to run the vm list
cmdlet. The following command lists the virtual machines in a resource group:
az vm list -resource-group resourceGroupName
Once you know the virtual machine, you can use the vm show
cmdlet to get its resource ID:
az vm show -resource-group resourceGroupName -name virtualMachineName
Retrieve security group view
The next step is to retrieve the security group view result.
az network watcher show-security-group-view --resource-group resourceGroupName --vm vmName
Viewing the results
The following example is a shortened response of the results returned. The results show all the effective and applied security rules on the virtual machine broken down in groups of NetworkInterfaceSecurityRules, DefaultSecurityRules, and EffectiveSecurityRules.
{
"networkInterfaces": [
{
"id": "/subscriptions/00000000-0000-0000-0000-0000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkInterfaces/{nicName}",
"resourceGroup": "{resourceGroupName}",
"securityRuleAssociations": {
"defaultSecurityRules": [
{
"access": "Allow",
"description": "Allow inbound traffic from all VMs in VNET",
"destinationAddressPrefix": "VirtualNetwork",
"destinationPortRange": "*",
"direction": "Inbound",
"etag": null,
"id": "/subscriptions/00000000-0000-0000-0000-0000000000000/resourceGroups//providers/Microsoft.Network/networkSecurityGroups/{nsgName}/defaultSecurityRules/AllowVnetInBound",
"name": "AllowVnetInBound",
"priority": 65000,
"protocol": "*",
"provisioningState": "Succeeded",
"resourceGroup": "",
"sourceAddressPrefix": "VirtualNetwork",
"sourcePortRange": "*"
}...
],
"effectiveSecurityRules": [
{
"access": "Deny",
"destinationAddressPrefix": "*",
"destinationPortRange": "0-65535",
"direction": "Outbound",
"expandedDestinationAddressPrefix": null,
"expandedSourceAddressPrefix": null,
"name": "DefaultOutboundDenyAll",
"priority": 65500,
"protocol": "All",
"sourceAddressPrefix": "*",
"sourcePortRange": "0-65535"
},
{
"access": "Allow",
"destinationAddressPrefix": "VirtualNetwork",
"destinationPortRange": "0-65535",
"direction": "Outbound",
"expandedDestinationAddressPrefix": [
"10.1.0.0/24",
"168.63.129.16/32"
],
"expandedSourceAddressPrefix": [
"10.1.0.0/24",
"168.63.129.16/32"
],
"name": "DefaultRule_AllowVnetOutBound",
"priority": 65000,
"protocol": "All",
"sourceAddressPrefix": "VirtualNetwork",
"sourcePortRange": "0-65535"
},...
],
"networkInterfaceAssociation": {
"id": "/subscriptions/00000000-0000-0000-0000-0000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkInterfaces/{nicName}",
"resourceGroup": "{resourceGroupName}",
"securityRules": [
{
"access": "Allow",
"description": null,
"destinationAddressPrefix": "*",
"destinationPortRange": "3389",
"direction": "Inbound",
"etag": "W/\"efb606c1-2d54-475a-ab20-da3f80393577\"",
"id": "/subscriptions/00000000-0000-0000-0000-0000000000000/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkSecurityGroups/{nsgName}/securityRules/default-allow-rdp",
"name": "default-allow-rdp",
"priority": 1000,
"protocol": "TCP",
"provisioningState": "Succeeded",
"resourceGroup": "{resourceGroupName}",
"sourceAddressPrefix": "*",
"sourcePortRange": "*"
}
]
},
"subnetAssociation": null
}
}
]
}
Next steps
Visit Auditing Network Security Groups (NSG) with Network Watcher to learn how to automate validation of Network Security Groups.
Learn more about the security rules that are applied to your network resources by visiting Security group view overview