Forum Discussion

venu15's avatar
venu15
Copper Contributor
Apr 06, 2023
Solved

Kusto Query for troubleshooting the Network Security Group

Hi Team,

 

i need some help on Kusto Query for troubleshooting the Network Security Group connectivity between source IP and Destination IP,

 

can someone please help in Kusto Query to check the NSG logs for source and destination to check connectivity is allowed between source and destination.

 

I'm very new to Kusto Query so posted here, appreciate for help

 

Source Ip : 10.226.16.165

destination :  159.123.12.3

Azure Log Analytics
Custom Logs and Custom Fields
Diagnostic Logs & settings
Log Analytics
  • Clive_Watson's avatar
    Clive_Watson
    Apr 06, 2023

    venu15 Please try this as an example to build on 

    AzureNetworkAnalytics_CL
| where FlowStatus_s != "A"  // Allowed / D=Denied
    | extend 
        DstIpAddr = iff(isnotempty(DestIP_s),
                        DestIP_s,
                        split(DestPublicIPs_s, '|')[0]),
        SrcIpAddr = iff(isnotempty(SrcIP_s),
                        SrcIP_s,
                        split(SrcPublicIPs_s, '|')[0])
| where SrcIpAddr == "10.226.16.165" and DstIpAddr == "159.123.12.3"

2 Replies

Sort By
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Apr 06, 2023

    venu15 Please try this as an example to build on 

    AzureNetworkAnalytics_CL
| where FlowStatus_s != "A"  // Allowed / D=Denied
    | extend 
        DstIpAddr = iff(isnotempty(DestIP_s),
                        DestIP_s,
                        split(DestPublicIPs_s, '|')[0]),
        SrcIpAddr = iff(isnotempty(SrcIP_s),
                        SrcIP_s,
                        split(SrcPublicIPs_s, '|')[0])
| where SrcIpAddr == "10.226.16.165" and DstIpAddr == "159.123.12.3"
    • Clive_Watson's avatar
      Clive_Watson
      Bronze Contributor
      Apr 06, 2023
      Sorry line #2 should have been:

      | where FlowStatus_s == "A"

Resources