Kusto Query for troubleshooting the Network Security Group

Hi Team, i need some help on Kusto Query for troubleshooting the Network Security Group connectivity between source IP and Destination IP, can someone please help in Kusto Query to check the ...

Azure Log Analytics

Custom Logs and Custom Fields

Diagnostic Logs & settings

Log Analytics

Clive_Watson

Apr 06, 2023

venu15 Please try this as an example to build on

AzureNetworkAnalytics_CL
| where FlowStatus_s != "A"  // Allowed / D=Denied
    | extend 
        DstIpAddr = iff(isnotempty(DestIP_s),
                        DestIP_s,
                        split(DestPublicIPs_s, '|')[0]),
        SrcIpAddr = iff(isnotempty(SrcIP_s),
                        SrcIP_s,
                        split(SrcPublicIPs_s, '|')[0])
| where SrcIpAddr == "10.226.16.165" and DstIpAddr == "159.123.12.3"

Clive_Watson

Bronze Contributor

Apr 06, 2023

venu15 Please try this as an example to build on

AzureNetworkAnalytics_CL
| where FlowStatus_s != "A"  // Allowed / D=Denied
    | extend 
        DstIpAddr = iff(isnotempty(DestIP_s),
                        DestIP_s,
                        split(DestPublicIPs_s, '|')[0]),
        SrcIpAddr = iff(isnotempty(SrcIP_s),
                        SrcIP_s,
                        split(SrcPublicIPs_s, '|')[0])
| where SrcIpAddr == "10.226.16.165" and DstIpAddr == "159.123.12.3"

Clive_Watson

Bronze Contributor

Apr 06, 2023

Sorry line #2 should have been:

| where FlowStatus_s == "A"

Forum Discussion

Kusto Query for troubleshooting the Network Security Group

Resources