Microsoft.web.sites.networkconfig.write remediation

​

Event Information

• The microsoft.web.sites.networkConfig.write event in Azure for AzureWebService refers to a configuration change made to the network settings of a web app hosted on Azure.
• This event indicates that a modification has been made to the network configuration of the Azure Web App, such as changes to the virtual network integration, IP restrictions, or custom domain settings.
• It is important to monitor this event as it can help track any changes made to the network configuration of the web app, ensuring that the desired network settings are maintained and any unauthorized modifications are detected.

​

Examples

1. Unauthorized changes to network configurations: If security is impacted with microsoft.web.sites.networkConfig.write in Azure for AzureWebService, it could potentially allow unauthorized users to modify network configurations of the web application. This could lead to the exposure of sensitive data, unauthorized access to resources, or disruption of the application’s functionality.
2. Network traffic interception: A security impact could occur if an attacker gains access to the network configurations through microsoft.web.sites.networkConfig.write. They could potentially intercept network traffic, allowing them to eavesdrop on sensitive information being transmitted between the web application and its users. This could result in data breaches or unauthorized access to sensitive data.
3. Denial of Service (DoS) attacks: If security is compromised with microsoft.web.sites.networkConfig.write, an attacker could potentially manipulate the network configurations to launch DoS attacks against the web application. By overwhelming the application’s network resources, the attacker could render the application unavailable to legitimate users, causing disruption to business operations and potential financial losses.

​

Remediation

​

Using Console

1. Enable Azure Security Center:
   • Go to the Azure portal and search for “Security Center” in the search bar.
   • Select “Security Center” from the results and click on it.
   • In the Security Center dashboard, click on “Pricing & settings” in the left-hand menu.
   • Choose the subscription and resource group where your AzureWebService is located.
   • Click on “Apply to all resources” to enable Security Center for all resources in the selected resource group.
   • Review the pricing tier options and select the appropriate tier for your needs.
   • Click on “Save” to enable Security Center.
2. Configure Network Security Groups (NSGs):
   • Go to the Azure portal and search for “Virtual machines” in the search bar.
   • Select “Virtual machines” from the results and click on it.
   • Find the virtual machine associated with your AzureWebService and click on it.
   • In the virtual machine’s overview page, click on “Networking” in the left-hand menu.
   • Under “Inbound port rules” and “Outbound port rules”, review the existing rules and remove any unnecessary open ports.
   • Add specific rules to allow only the necessary inbound and outbound traffic for your AzureWebService.
   • Click on “Save” to apply the changes to the NSG.
3. Implement Azure Monitor:
   • Go to the Azure portal and search for “Monitor” in the search bar.
   • Select “Monitor” from the results and click on it.
   • In the Monitor dashboard, click on “Activity log” in the left-hand menu.
   • Review the activity log events related to your AzureWebService and identify any suspicious or unauthorized activities.
   • Set up alerts and notifications for specific types of events that require immediate attention.
   • Configure log analytics to collect and analyze logs from your AzureWebService for proactive monitoring and threat detection.
   • Click on “Save” to apply the monitoring and alerting configurations.

​

Using CLI

1. Enable diagnostic logs:
   • Use the az webapp log config command to enable diagnostic logs for the Azure Web Service.
   • Specify the desired log level and retention days using the --web-server-logging and --detailed-error-messages parameters respectively.
2. Enable HTTPS Only:
   • Use the az webapp update command to enable HTTPS Only for the Azure Web Service.
   • Set the --https-only parameter to true to enforce HTTPS communication.
3. Enable Web Application Firewall (WAF):
   • Use the az webapp waf config set command to enable Web Application Firewall for the Azure Web Service.
   • Specify the desired rule set type using the --firewall-mode parameter.
   • Configure additional settings like custom rules, exclusions, etc., as per your requirements.

​

Using Python

1. Monitoring and Alerting:
   • Use the Azure Monitor service to set up monitoring and alerting for your Azure Web Service.
   • Use the Azure SDK for Python to programmatically configure and manage alerts.
   • Here’s an example Python script to create an alert rule for a specific metric:
   Copy

   Ask AI

   from azure.mgmt.monitor import MonitorManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a MonitorManagementClient
   monitor_client = MonitorManagementClient(credential, subscription_id)
   
   # Define the alert rule properties
   alert_rule_properties = {
       "name": "MyAlertRule",
       "location": "eastus",
       "description": "My alert rule",
       "severity": 2,
       "enabled": True,
       "condition": {
           "odata.type": "Microsoft.Azure.Management.Monitor.Models.ThresholdRuleCondition",
           "dataSource": {
               "odata.type": "Microsoft.Azure.Management.Monitor.Models.RuleMetricDataSource",
               "resourceUri": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{webAppName}",
               "metricName": "Http5xx",
               "timeAggregation": "Average"
           },
           "operator": "GreaterThan",
           "threshold": 10,
           "windowSize": "PT5M"
       },
       "actions": []
   }
   
   # Create the alert rule
   monitor_client.alert_rules.create_or_update(
       resource_group_name,
       web_app_name,
       alert_rule_name,
       alert_rule_properties
   )
   

2. Security and Compliance:
   • Implement Azure Security Center to continuously monitor the security posture of your Azure Web Service.
   • Utilize Azure Policy to enforce compliance standards and best practices.
   • Here’s an example Python script to assign a built-in policy definition to a resource group:
   Copy

   Ask AI

   from azure.mgmt.resource import PolicyClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a PolicyClient
   policy_client = PolicyClient(credential, subscription_id)
   
   # Assign a built-in policy definition to a resource group
   policy_client.policy_assignments.create(
       scope="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}",
       policy_assignment_name="MyPolicyAssignment",
       policy_definition_id="/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionId}"
   )
   

3. Cost Optimization:
   • Utilize Azure Cost Management and Billing to monitor and optimize your Azure Web Service costs.
   • Use the Azure SDK for Python to programmatically retrieve cost and usage data.
   • Here’s an example Python script to retrieve cost and usage data for a specific time range:
   Copy

   Ask AI

   from azure.mgmt.consumption import ConsumptionManagementClient
   from azure.identity import DefaultAzureCredential
   
   # Authenticate using DefaultAzureCredential
   credential = DefaultAzureCredential()
   
   # Create a ConsumptionManagementClient
   consumption_client = ConsumptionManagementClient(credential, subscription_id)
   
   # Retrieve cost and usage data for a specific time range
   cost_usage_data = consumption_client.usage_details.list(
       filter="properties/usageStart ge '2022-01-01' and properties/usageEnd le '2022-01-31'",
       top=10
   )
   
   for item in cost_usage_data:
       print(item.name, item.quantity, item.cost)