In this video, we're gonna configure visibility within Microsoft Azure, and again, all of this is gonna be done through orchestration provided through the multi cloud defense SaaS controller. So join me as we configure this visibility.00:05Right now. What we're gonna do is we're going to again within CDO or what's now known as Cisco Cloud control security cloud control, we are gonna head over to the multi cloud defense portal. There are ways you can do this from within security cloud control itself, but I like to show everything from the same kind of.00:17Common vantage point that we've been using in all the previous videos. So I'm gonna open up the multi cloud defense sass controller and and again much like we did with the AWS visibility setup, I'm going to go into the setup wizard. This is the only place to actively configure the visibility portion of this.00:36I'm going to click enable Visibility and then I'm gonna go ahead and select the Azure account that we onboarded in a previous video.00:56Now, a little bit different than AWS, Azure does flow logging at what they call the NSG level. So we're gonna be configuring NSG flow logging, but there are a couple of prerequisite steps in order for us to be able to do this. So I'm gonna go ahead and pick out the region. I think we use.01:04East two and let's really quickly make sure I cannot remember.01:24Yeah, East US, I believe East US is, so this was our virtual network. Let's just make sure it's in East US, Yeah east US. So you do have to have network Watcher actively enabled in that region. And then it says please create a storage account by executing the command below within your Azure cloud.01:39So and what this this does is it sets up the.01:59Storage account for us. Again, it kind of automates the creation if you don't already have one set up that we can use down here. The one thing I'll mention when you when you run this is it asks you to provide a storage account name here. Azure is very specific about like underscores and stuff so.02:04Just make sure that from a character standpoint, you fill something in here that will work. I believe if we type something in here, and I maybe wrong.02:23Okay, I thought it maybe would update this automatically, but it does not look like it does. So what we'll do is we'll copy this out. Let's go over here, actually look and see if we have a storage account with a terri terraform state. I'm gonna I'm gonna use something different though, so let's go ahead and open up the.02:34Cloudshell. This again is gonna be all bash. We do not want it to be in the PowerShell shell. We want it to be in the bash shell, which it is. So let's go ahead and paste that in.02:54I will head back and give it a proper storage account name. Let's back through this. Let's say I'm actually gonna, I think we put it within quotation marks, we'll say chase.03:11And YouTube and demo storage account and let's hit enter, see what it does. We do want to end the pay as you go. So we'll say yes.03:31Is this the subscription you want to onboard and if there's any like errors within the naming or naming convention or if there's anything duplicated, it will let you know, so as long as it's complete successfully.03:49We should be, we should be good to go, it will make sure the network watcher's enabled, it will create an event grid subscription.04:09So again, all this is just kind of ways that we, you know, help, help our customers out. We try to keep you from having to do stuff manually if you choose not to. So once this completes, we should see.04:34Another I'm gonna kind of lower this just a little bit, and we do see a new storage account, so let's copy this out.04:51Can't look back through everything that it did here. I would expect to see. Storage accounts show up in here. Oh, I have the subscription set.05:15Select all. There we go. So it did create the storage account, looks like I had another one in here as well for cloudshell could have used. But what we'll do is we'll go ahead and paste that in here and notice NO NSG showed up. So let's create an NSG. I don't have any workloads out there.05:32Right now, but let's just go ahead and pretend that I have an NSG I want to set up, put it in the pay as you go. We'll put it in SMCD, and we'll just call this Jason.05:51NSG, NO tags, we're gonna fly kinda loose here, and we'll create that. This should happen fairly quick. And once this is created, which it is now, we'll go to the resource.06:13And we should, if we look at the.06:33NSG flow logs, there's nothing in here right now, so let's go back to multi cloud defense. We'll hit the little refresh arrow here. We see that Jason YouTube NSG show up, so I'm gonna go ahead and.06:45Select that, meaning what we want to do is enable NSG flow logging on anything connected to that network security group. The one difference from AWS that you'll notice here is we do not have DNS query logging with regards to Azure. That's not because of of multi cloud defense or anything Cisco did. That's because right now there's NO mechanism in place without.06:59Then Microsoft Azure to do DNS query logging, you'll see that if the CSP has that capability, we typically leverage it. So with AWS, we leverage it within Google Cloud, we're gonna leverage it.07:19But within Microsoft Azure, it's unfortunately not available to us. So what I want to do is go ahead and click next here and this should again success. So we have, we have victory, and if we go back to Microsoft Azure and let's just refresh the screen.07:31We should see this, very quickly configured with NSG flow logging, so that kind of happened as we were trying to refresh there. So again, just taking kind of a look at what this flow log entails, it's within the subscription that we had pay as you go.07:50So.08:10It's going to this Json YouTube demo storage account that we just created with that bash shell script. And again, it's just gonna be your typical NSG flow logging capability, so as you know, we attach instances or resources to this network security group, as traffic is passed either at ingress or egressed from.08:11Those instances, we will be able to have that centralized logging coming in from Azure into the multi cloud defense controller. Again, we'll do all the typical inventory enrichment that you saw us do with AWS, but as it sits right now, I do not have any instances producing traffic within.08:30Azure itself. So, again, I think I went through it pretty great detail in the AWS video, but when you want to see these logs, you simply go to under the investigate ribbon, DNS or VPC. You're gonna be able to see the individual logs as they're being brought into.08:50Multi cloud defense. If we wanted to back this out again, there's NO mechanism within multi cloud defense itself to back those configurations from a flow logging perspective out of the cloud service provider. So what we would do, again.09:08Very similar to what we did in AWS. If I wanted to clean up what we had done within that those previous steps, I would simply come in here, I would select the the NSG flow logs within that respective NSG, it's a little bit kind of wonky. There's a couple different ways you can do it within here. If I remember correctly, we could go to this little.09:25Little three dots on this side and we could disable or we could delete it or you can click directly on the hyperlink that is the name of this NSG flow log, and typically you have the ability within here to delete. It doesn't look like you do. So I guess you do actually have to go into those three dots in the far right hand side.09:45And delete if you want to delete these NSG flows, let's go ahead and do that. Save ourselves some cash, say delete. And again, it's gonna it's gonna do that. The one caveat here, right, is now you have to go into all these different nsgs and delete these kind of manually. That's, that's the one.10:04Step until we actually are providing that automation within our controller itself. You you do have to go into these individual nsgs and and clean these up.10:24As always, if you found this video useful, keep a key eye on this channel as we will be releasing more and more content around the deployment and uses of multi cloud defense and how you can use it to protect your cloud infrastructure. Thank you for watching. We.10:37We look forward to seeing you in the next video.10:48
