​
Event Information

  1. The Microsoft.Network.virtualNetworks.subnets.delete event in Azure for AzureNetwork indicates that a subnet within a virtual network has been deleted.
  2. This event signifies that any resources or services associated with the deleted subnet will no longer be accessible.
  3. It is important to review this event to ensure that the deletion was intentional and to take any necessary actions to update or reconfigure any dependent resources.

​
Examples

  1. Unauthorized deletion of subnets: If security is impacted with Microsoft.Network.virtualNetworks.subnets.delete in Azure for AzureNetwork, it could potentially lead to unauthorized deletion of subnets. This can result in the loss of network connectivity for resources within the affected subnet, leading to service disruption or potential data breaches.
  2. Misconfiguration of network security groups: Deleting subnets without proper planning and coordination can result in misconfiguration of network security groups (NSGs). NSGs are used to control inbound and outbound traffic to subnets, and deleting a subnet without updating the associated NSGs can leave resources exposed or cause unintended network access restrictions.
  3. Impact on network routing: Deleting subnets can also impact network routing within the virtual network. If subnets are deleted without considering the impact on routing tables and network gateways, it can lead to routing issues and potential disruption of network connectivity between resources.
To mitigate these security impacts, it is important to follow best practices such as implementing proper access controls, regularly reviewing and updating network configurations, and ensuring proper coordination and planning before deleting subnets. Additionally, utilizing automation and infrastructure-as-code practices can help enforce consistent and secure network configurations.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for Azure Network using the Azure console, you can follow these step-by-step instructions:
  1. Enable Network Security Groups (NSGs):
    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Network security groups” option from the left-hand menu.
    • Click on the “Add” button to create a new NSG or select an existing NSG.
    • Configure the NSG rules to allow only necessary inbound and outbound traffic.
    • Apply the NSG to the desired subnets or network interfaces.
  2. Implement Azure DDoS Protection Standard:
    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Distributed denial of service (DDoS) protection” option from the left-hand menu.
    • Click on the “Enable DDoS protection” button.
    • Choose the “Standard” tier for enhanced protection.
    • Configure the DDoS protection settings based on your requirements.
    • Apply the DDoS protection to the desired resources within the network.
  3. Enable Azure Firewall:
    • Go to the Azure portal and navigate to the desired Azure Network.
    • Select the “Azure Firewall” option from the left-hand menu.
    • Click on the “Add” button to create a new Azure Firewall or select an existing one.
    • Configure the firewall rules to allow or deny traffic based on your network security policies.
    • Associate the Azure Firewall with the desired subnets or network interfaces.
    • Monitor and manage the Azure Firewall to ensure effective network security.
Note: The above instructions provide a general guideline for remediating the mentioned issues in Azure Network using the Azure console. The specific steps may vary based on your Azure subscription, network configuration, and security requirements. It is recommended to refer to the official Azure documentation for detailed instructions and best practices.

​
Using CLI

To remediate issues related to Azure Network using Azure CLI, you can follow these steps:
  1. Enable Network Security Groups (NSGs) for Subnets:
    • Use the az network vnet subnet update command to update the subnet configuration.
    • Specify the --network-security-group parameter with the name or resource ID of the NSG you want to associate with the subnet.
  2. Implement Network Virtual Appliances (NVAs):
    • Use the az network vnet-gateway create command to create a virtual network gateway.
    • Specify the --gateway-type parameter as “Vpn” or “ExpressRoute” depending on your requirements.
    • Provide the necessary parameters like --name, --resource-group, --vnet, etc.
  3. Enable Azure Firewall:
    • Use the az network firewall create command to create an Azure Firewall.
    • Specify the --name, --resource-group, and --location parameters.
    • Configure the necessary rules and settings using the az network firewall network-rule and az network firewall application-rule commands.
Please note that the actual CLI commands may vary based on your specific requirements and Azure environment setup. Make sure to replace the placeholders with the appropriate values.

​
Using Python

To remediate issues related to AzureNetwork using Python, you can use the Azure SDK for Python. Here are three examples of how you can remediate common issues:
  1. Example 1: Enable Network Security Group (NSG) Flow Logs
    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Enable flow logs for the NSG by setting the enable_flow_logs property to True.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Enable flow logs for the NSG
nsg.enable_flow_logs = True

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)
  2. Example 2: Add a Network Security Rule to an NSG
    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Add a new security rule to the NSG by appending it to the security_rules list.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.network.models import SecurityRule

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Add a new security rule to the NSG
new_rule = SecurityRule(name="Allow-SSH", protocol="Tcp", source_port_range="*", destination_port_range="22", access="Allow", direction="Inbound")
nsg.security_rules.append(new_rule)

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)
  3. Example 3: Update Network Security Group Rules
    • Use the azure.mgmt.network package to retrieve the NSG resource.
    • Modify the existing security rules in the NSG as required.
    • Update the NSG resource using the network_client.network_security_groups.create_or_update method.
    from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()
network_client = NetworkManagementClient(credential, subscription_id)

# Retrieve the NSG resource
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Modify the existing security rules in the NSG
for rule in nsg.security_rules:
    if rule.name == "Allow-SSH":
        rule.access = "Deny"

# Update the NSG resource
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)