Quick Start Security for Azure Network Security Groups
Thank you!
We got your information.
Coralogix Extension For Azure Network Security Groups Includes:
Alerts - 4
Stay on top of Azure Network Security Groups key performance metrics. Keep everyone in the know with integration with Slack, PagerDuty and more.
A Security Group rule was deleted
This alert detects when an Azure security group rule was deleted. Impact Security group rules control access to multiple resources. Rule deletion should be inspected as it can expose resources to the outside world. It can also indicate an attacker activity to get access to internal resources or harm the company system. Mitigation Validate that the deletion was authorized and intended, revert and further investigate if not. MITRE Tactic: TA0003 MITRE Technique: T1531
A Security Group was deleted
This alert detects when an Azure security group was deleted. Impact Security groups control access to multiple resources. Group deletion should be inspected as it can expose resources to the outside world. It can also indicate an attacker activity to get access to internal resources or harm the company system. Mitigation Validate that the deletion was authorized and intended, revert and further investigate if not. MITRE Tactic: TA0003 MITRE Technique: T1531
A Security Group rule was created or modified
This alert detects when an Azure security group rule was created or modified. Impact Security group rules control access to multiple resources. Rule creation of modification should be inspected as they can expose resources to the outside world. It can also indicate an attacker activity get access to internal resources or harm the company system. Mitigation Validate that the change was authorized and intended, revert and further investigate if not. Give special attention rules that expose resources to RDP, SSH or to any/* locations. MITRE Tactic: TA0003 MITRE Technique: T1531
A Security Group was created or modified
This alert detects when an Azure security group was created or modified. Impact Security groups control access to multiple resources. Group creation of modification should be inspected as they can expose resources to the outside world. It can also indicate an attacker activity get access to internal resources or harm the company system. Mitigation Validate that the change was authorized and intended, revert and further investigate if not. Give special attention modifications that expose resources to RDP, SSH or to any/* locations. MITRE Tactic: TA0003 MITRE Technique: T1531
Integration
Learn more about Coralogix's out-of-the-box integration with Azure Network Security Groups in our documentation.
