Apply Adaptive Network Hardening across multiple Subscriptions

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.

Applying network security groups (NSG) to filter traffic to and from resources, improves your network security posture. However, there can still be some cases in which the actual traffic flowing through the NSG is a subset of the NSG rules defined. Adaptive network hardening provides recommendations to further harden the NSG rules. It uses a machine learning algorithm that factors in actual traffic, known trusted configuration, threat intelligence, and other indicators of compromise, and then provides recommendations to allow traffic only from specific IP/port tuples.

For example, let's say the existing NSG rule is to allow traffic from 100.xx.xx.10/24 on port 8081. Based on traffic analysis, adaptive network hardening might recommend narrowing the range to allow traffic from 100.xx.xx.10/29 and deny all other traffic to that port.

Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP): 13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215

Pre-Requisite:

- Az Modules must be installed

- Service principal created as part of Step 1 must be having contributor access to all subscriptions

Steps to follow:

Step 1: Create a service principal

Please refer: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-porta...

https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-5...

Post creation of service principal, please retrieve below values.

Tenant Id
Client Secret
Client Id

Step 2: Create a PowerShell function which will be used in generating authorization token

function Get-apiHeader{ [CmdletBinding()] Param ( [Parameter(Mandatory=$true)] [System.String] [ValidateNotNullOrEmpty()] $TENANTID, [Parameter(Mandatory=$true)] [System.String] [ValidateNotNullOrEmpty()] $ClientId, [Parameter(Mandatory=$true)] [System.String] [ValidateNotNullOrEmpty()] $PasswordClient, [Parameter(Mandatory=$true)] [System.String] [ValidateNotNullOrEmpty()] $resource ) $tokenresult=Invoke-RestMethod -Uri https://login.microsoftonline.com/$TENANTID/oauth2/token?api-version=1.0 -Method Post -Body @{"grant_type" = "client_credentials"; "resource" = "https://$resource/"; "client_id" = "$ClientId"; "client_secret" = "$PasswordClient" } $token=$tokenresult.access_token $Header=@{ 'Authorization'="Bearer $token" 'Host'="$resource" 'Content-Type'='application/json' } return $Header }

Step 3: Invoke API to retrieve authorization token using function created in above step

Note: Replace $TenantId, $ClientId and $ClientSecret with value captured in step 1

$AzureApiheaders = Get-apiHeader -TENANTID $TenantId -ClientId $ClientId -PasswordClient $ClientSecret -resource "management.azure.com"

Step 4: Extracting csv file containing list of all adaptive network hardening suggestion from Azure Resource Graph

Please refer: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/governance/resource-graph/first-que...

Azure Resource graph explorer: https://docs.microsoft.com/en-us/azure/governance/resource-graph/overview

Query:

securityresources | where type == "microsoft.security/assessments" | extend source = tostring(properties.resourceDetails.Source) | extend resourceId = trim(" ", tolower(tostring(case(source =~ "azure", properties.resourceDetails.Id, source =~ "aws", properties.resourceDetails.AzureResourceId, source =~ "gcp", properties.resourceDetails.AzureResourceId, extract("^(.+)/providers/Microsoft.Security/assessments/.+$",1,id))))) | extend status = trim(" ", tostring(properties.status.code)) | extend cause = trim(" ", tostring(properties.status.cause)) | extend assessmentKey = tostring(name) | where assessmentKey == "f9f0eed0-f143-47bf-b856-671ea2eeed62"

Click on "Download as CSV" and store at location where adaptive network hardening script is present. Rename the file as "adaptivehardeningextract"

Set-Location $PSScriptRoot $RootFolder = Split-Path $MyInvocation.MyCommand.Path $ParameterCSVPath =$RootFolder + "\adaptivehardeningextract.csv" if(Test-Path -Path $ParameterCSVPath) { $TableData = Import-Csv $ParameterCSVPath } foreach($Data in $TableData) { $resourceid=$Data.resourceid $resourceURL="https://management.azure.com$resourceid/providers/Microsoft.Security/adaptiveNetworkHardenings/default?api-version=2020-01-01" $resourcedetails=(Invoke-RestMethod -Uri $resourceURL -Headers $AzureApiheaders -Method GET) $resourceDetailjson = $resourcedetails.properties.rules | ConvertTo-Json $nsg = $resourcedetails.properties.effectiveNetworkSecurityGroups.networksecuritygroups | ConvertTo-Json if($resourceDetailjson -ne $null) { $body=@" { "rules": [$resourceDetailjson] , "networkSecurityGroups": [$nsg] } "@ $enforceresourceURL = "https://management.azure.com$resourceid/providers/Microsoft.Security/adaptiveNetworkHardenings/default/enforce?api-version=2020-01-01" $Enforcedetails=(Invoke-RestMethod -Uri $enforceresourceURL -Headers $AzureApiheaders -Method POST -Body $body) } }

References:

https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening

Leave a Reply Cancel reply