Microsoft.web.sites.networkconfig.delete remediation

​

Event Information

• The microsoft.web.sites.networkConfig.delete event in Azure for Azure Web Service indicates that the network configuration for a web app has been deleted.
• This event typically occurs when a user or an automated process removes the network configuration settings associated with a web app.
• The deletion of the network configuration may impact the connectivity and accessibility of the web app, as it removes any custom network settings that were previously defined.

​

Examples

1. Unauthorized deletion of network configurations: If security is impacted with microsoft.web.sites.networkConfig.delete in Azure for AzureWebService, it could potentially allow unauthorized individuals to delete network configurations associated with the web application. This could lead to a loss of network connectivity or expose the application to potential security vulnerabilities.
2. Network misconfiguration: Deleting network configurations without proper planning or documentation can result in network misconfigurations. This can lead to unintended consequences such as loss of connectivity, disruption of services, or exposure of sensitive data to unauthorized entities.
3. Access control issues: If security is impacted with microsoft.web.sites.networkConfig.delete in Azure for AzureWebService, it could indicate access control issues. Unauthorized users gaining access to the capability to delete network configurations can bypass security measures and potentially compromise the web application or the underlying infrastructure. It is crucial to ensure that only authorized personnel have the necessary permissions to perform such actions.

​

Remediation

​

Using Console

1. Enable Azure Security Center:
   • Go to the Azure portal and search for “Security Center” in the search bar.
   • Select “Security Center” from the results and click on it.
   • In the Security Center dashboard, click on “Pricing & settings” in the left menu.
   • Choose the subscription and resource group where your AzureWebService is located.
   • Click on “Apply to all resources” to enable Security Center for all resources in the selected resource group.
   • Review the pricing tier options and select the appropriate tier for your needs.
   • Click on “Save” to enable Security Center.
2. Implement Network Security Groups (NSGs):
   • Go to the Azure portal and search for “Virtual machines” in the search bar.
   • Select “Virtual machines” from the results and click on it.
   • Find the virtual machine(s) associated with your AzureWebService.
   • Select the virtual machine and click on “Networking” in the left menu.
   • Under “Inbound port rules”, click on “Add inbound port rule” to add a new rule.
   • Configure the rule to allow only the necessary inbound traffic for your AzureWebService.
   • Repeat the above steps for all virtual machines associated with your AzureWebService.
3. Implement Azure Key Vault for secrets management:
   • Go to the Azure portal and search for “Key vaults” in the search bar.
   • Select “Key vaults” from the results and click on it.
   • Click on “Add” to create a new key vault.
   • Provide the necessary details like name, subscription, resource group, and region.
   • Configure access policies to grant necessary permissions to your AzureWebService.
   • Click on “Review + create” and then “Create” to create the key vault.
   • Once the key vault is created, you can store and manage secrets securely.

​

Using CLI

1. Enable diagnostic logs:
   • Use the az webapp log config command to enable diagnostic logs for the Azure Web Service.
   • Specify the desired log level and retention days using the --web-server-logging and --detailed-error-messages parameters respectively.
2. Enable HTTPS Only:
   • Use the az webapp update command to enable HTTPS Only for the Azure Web Service.
   • Set the --https-only parameter to true to enforce HTTPS communication.
3. Enable Web Application Firewall (WAF):
   • Use the az webapp waf config set command to enable Web Application Firewall for the Azure Web Service.
   • Specify the desired rule set type using the --firewall-mode parameter.
   • Configure additional settings like custom rules, exclusions, etc., as per your requirements.

​

Using Python

1. Monitoring and Alerting:
   • Use the Azure Monitor service to set up monitoring and alerting for your Azure Web Service.
   • Use the Azure SDK for Python to programmatically create and configure alerts for specific metrics or events.
   • Here’s an example Python script to create an alert rule for a specific metric using the Azure SDK for Python:
   Copy

   Ask AI

   from azure.identity import DefaultAzureCredential
   from azure.mgmt.monitor import MonitorManagementClient
   from azure.mgmt.monitor.models import AlertRuleResource
   
   # Authenticate using the default credentials
   credential = DefaultAzureCredential()
   
   # Create a MonitorManagementClient
   monitor_client = MonitorManagementClient(credential, subscription_id)
   
   # Define the alert rule properties
   alert_rule = AlertRuleResource(
       location='global',
       description='High CPU usage alert',
       severity='3',
       enabled=True,
       condition={
           'odata.type': 'Microsoft.Azure.Management.Monitor.Models.ThresholdRuleCondition',
           'dataSource': {
               'odata.type': 'Microsoft.Azure.Management.Monitor.Models.RuleMetricDataSource',
               'resourceUri': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{webAppName}',
               'metricName': 'CpuPercentage',
               'operator': 'GreaterThan',
               'threshold': 80,
               'timeAggregation': 'Average',
               'windowSize': 'PT5M'
           }
       },
       actions=[
           {
               'odata.type': 'Microsoft.Azure.Management.Monitor.Models.RuleEmailAction',
               'sendToServiceOwners': True
           }
       ]
   )
   
   # Create the alert rule
   monitor_client.alert_rules.create_or_update(
       resource_group_name='your-resource-group',
       rule_name='high-cpu-alert',
       parameters=alert_rule
   )
   

2. Security and Compliance:
   • Implement Azure Security Center to continuously monitor the security posture of your Azure Web Service.
   • Use the Azure SDK for Python to programmatically enable and configure security policies.
   • Here’s an example Python script to enable a security policy using the Azure SDK for Python:
   Copy

   Ask AI

   from azure.identity import DefaultAzureCredential
   from azure.mgmt.security import SecurityCenter
   
   # Authenticate using the default credentials
   credential = DefaultAzureCredential()
   
   # Create a SecurityCenter client
   security_center_client = SecurityCenter(credential, subscription_id)
   
   # Enable a security policy
   security_center_client.policies.create_or_update(
       resource_group_name='your-resource-group',
       policy_name='your-policy-name',
       parameters={
           'displayName': 'Your Policy',
           'description': 'Your policy description',
           'policyRule': {
               'if': {
                   'field': 'type',
                   'equals': 'Microsoft.Web/sites'
               },
               'then': {
                   'effect': 'audit',
                   'details': {
                       'type': 'AuditIfNotExists',
                       'existenceCondition': {
                           'field': 'Microsoft.Web/sites/tlsVersion',
                           'equals': '1.2'
                       }
                   }
               }
           }
       }
   )
   

3. Performance Optimization:
   • Use Azure Application Insights to monitor and optimize the performance of your Azure Web Service.
   • Use the Azure SDK for Python to programmatically configure and retrieve performance metrics.
   • Here’s an example Python script to retrieve performance metrics using the Azure SDK for Python:
   Copy

   Ask AI

   from azure.identity import DefaultAzureCredential
   from azure.monitor.query import LogsQueryClient
   
   # Authenticate using the default credentials
   credential = DefaultAzureCredential()
   
   # Create a LogsQueryClient
   logs_query_client = LogsQueryClient(credential)
   
   # Query performance metrics
   response = logs_query_client.query(
       workspace_id='your-workspace-id',
       query='AppRequests | summarize avg(duration) by bin(timestamp, 1h)',
       timespan='P1D'
   )
   
   # Process the response
   for row in response.tables[0].rows:
       timestamp = row[0]
       avg_duration = row[1]
       print(f'Timestamp: {timestamp}, Average Duration: {avg_duration}')