AzureIdentifyNSGExposureRule
Identifies the first inbound Allow rule in a specified NSG that matches network exposure criteria. Returns rule details and a list of available priority numbers for inserting higher-priority rules.
python · Cloud Security Policy Management
Details
| ID | AzureIdentifyNSGExposureRule |
|---|---|
| Language | python |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
This script identifies the first inbound Allow rule in the specified NSG that matches the criteria for network exposure. It returns details about the identified rule as well as a list of available priority numbers to insert new security rules with a higher priority.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 6.10.0 |
Inputs
| Argument Name | Description |
|---|---|
| subscription_id | The Azure Subscription ID where the NSG resides. |
| resource_group_name | The Azure Resource Group Name where the NSG resides. |
| network_security_group_name | The Azure Network Security Group (NSG) Name to analyze for exposure rules. |
| private_ip_addresses | The destination private IP address(es) of the Virtual Machine interface. |
| port | TCP/UDP port to be restricted. |
| protocol | Protocol of the port to be restricted. |
| priority_count | The number of available priority values below the matching rule to return. |
| integration_instance | The Azure Integration Instance to use. |
Outputs
| Path | Description | Type |
|---|---|---|
| AzurePublicExposure.MatchingRuleName | The name of the matching inbound security rule in the NSG that allows exposure. | String |
| AzurePublicExposure.MatchingRulePriority | The priority number of the matching inbound security rule. | Number |
| AzurePublicExposure.NextAvailablePriorityValues | The next available priority values to insert new security rules before the matching rule, given in descending order. | Unknown |
| AzurePublicExposure.IntegrationInstance | The Azure Integration Instance used for identification. | String |
args: - description: The Azure subscription ID where the NSG resides. name: subscription_id required: true - description: The Azure resource group name where the NSG resides. name: resource_group_name required: true - description: The Azure Network Security Group (NSG) name to analyze for exposure rules. name: network_security_group_name required: true - description: The destination private IP address(es) of the Virtual Machine interface. name: private_ip_addresses required: true isArray: true - description: The TCP/UDP port to restrict. name: port required: true - description: The protocol of the port to restrict. auto: PREDEFINED name: protocol predefined: - tcp - udp required: true - description: The number of available priority values below the matching rule to return. name: priority_count defaultValue: '2' - description: The Azure integration instance to use. name: integration_instance comment: Identifies the first inbound Allow rule in a specified NSG that matches network exposure criteria. Returns rule details and a list of available priority numbers for inserting higher-priority rules. commonfields: id: AzureIdentifyNSGExposureRule version: -1 enabled: true name: AzureIdentifyNSGExposureRule outputs: - contextPath: AzurePublicExposure.MatchingRuleName description: The name of the matching inbound security rule in the NSG that allows exposure. type: String - contextPath: AzurePublicExposure.MatchingRulePriority description: The priority number of the matching inbound security rule. type: Number - contextPath: AzurePublicExposure.NextAvailablePriorityValues description: The available priority values, in descending order, for inserting rules before the matching rule. type: Unknown - contextPath: AzurePublicExposure.IntegrationInstance description: The Azure integration instance used for identification. type: String script: '' system: false timeout: '0' type: python subtype: python3 dependson: must: - Azure|||azure-nsg-security-rules-list dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.10.0 tests: - No tests (auto formatted)