流量分析架构中包含新字段的示例查询(2019 年 8 月版架构更新)Sample queries with new fields in the Traffic Analytics schema (August 2019 schema update)

流量分析日志架构包含以下新字段:SrcPublicIPs_s、DestPublicIPs_s、NSGRule_s 。The Traffic Analytics log schema includes the following new fields: SrcPublicIPs_s, DestPublicIPs_s, NSGRule_s. 新字段提供有关源和目标 IP 的信息并且可以简化查询。The new fields provide information about source and destination IPs, and they simplify queries.

在接下来的几个月内,以下较旧的字段将弃用:VMIP_s、Subscription_g、Region_s、NSGRules_s、Subnet_s、VM_s、NIC_s、PublicIPs_s、FlowCount_d 。In the next few months, the following older fields will be deprecated: VMIP_s, Subscription_g, Region_s, NSGRules_s, Subnet_s, VM_s, NIC_s, PublicIPs_s, FlowCount_d.

以下三个示例演示如何将旧字段替换为新字段。The following three examples show how to replace the old fields with the new ones.

示例 1:VMIP_s、Subscription_g、Region_s、Subnet_s、VM_s、NIC_s 和 PublicIPs_s 字段Example 1: VMIP_s, Subscription_g, Region_s, Subnet_s, VM_s, NIC_s, and PublicIPs_s fields

我们不必从 AzurePublic 和 ExternalPublic 流的 FlowDirection_s 字段中推断源和目标情况。We don't have to infer source and destination cases from the FlowDirection_s field for AzurePublic and ExternalPublic flows. 对于网络虚拟设备,FlowDirection_s 字段也可能不适合使用。It can also be inappropriate to use the FlowDirection_s field for a network virtual appliance.

AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog" and FASchemaVersion_s == "1"
| extend isAzureOrExternalPublicFlows = FlowType_s in ("AzurePublic", "ExternalPublic")
| extend SourceAzureVM = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', VM_s, "N/A"), VM1_s),
SourceAzureVMIP = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', VM_s, "N/A"), SrcIP_s),
SourceAzureVMSubscription = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', Subscription_g, "N/A"), Subscription1_g),
SourceAzureRegion = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', Region_s, "N/A"), Region1_s),
SourceAzureSubnet = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', Subnet_s, "N/A"), Subnet1_s),
SourceAzureNIC = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'O', NIC_s, "N/A"), NIC1_s),
DestAzureVM = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', VM_s, "N/A"), VM2_s),
DestAzureVMIP = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', VM_s, "N/A"), DestIP_s),
DestAzureVMSubscription = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', Subscription_g, "N/A"), Subscription2_g),
DestAzureRegion = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', Region_s, "N/A"), Region2_s),
DestAzureSubnet = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', Subnet_s, "N/A"), Subnet2_s),
DestAzureNIC = iif(isAzureOrExternalPublicFlows, iif(FlowDirection_s == 'I', NIC_s, "N/A"), NIC2_s),
SourcePublicIPsAggregated = iif(isAzureOrExternalPublicFlows and FlowDirection_s == 'I', PublicIPs_s, "N/A"),
DestPublicIPsAggregated = iif(isAzureOrExternalPublicFlows and FlowDirection_s == 'O', PublicIPs_s, "N/A")
AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog" and FASchemaVersion_s == "2"
| extend SourceAzureVM = iif(isnotempty(VM1_s), VM1_s, "N/A"),
SourceAzureVMIP = iif(isnotempty(SrcIP_s), SrcIP_s, "N/A"),
SourceAzureVMSubscription = iif(isnotempty(Subscription1_g), Subscription1_g, "N/A"),
SourceAzureRegion = iif(isnotempty(Region1_s), Region1_s, "N/A"),
SourceAzureSubnet = iif(isnotempty(Subnet1_s), Subnet1_s, "N/A"),
SourceAzureNIC = iif(isnotempty(NIC1_s), NIC1_s, "N/A"),
DestAzureVM = iif(isnotempty(VM2_s), VM2_s, "N/A"),
DestAzureVMIP = iif(isnotempty(DestIP_s), DestIP_s, "N/A"),
DestAzureVMSubscription = iif(isnotempty(Subscription2_g), Subscription2_g, "N/A"),
DestAzureRegion = iif(isnotempty(Region2_s), Region2_s, "N/A"),
DestAzureSubnet = iif(isnotempty(Subnet2_s), Subnet2_s, "N/A"),
DestAzureNIC = iif(isnotempty(NIC2_s), NIC2_s, "N/A"),
SourcePublicIPsAggregated = iif(isnotempty(SrcPublicIPs_s), SrcPublicIPs_s, "N/A"),
DestPublicIPsAggregated = iif(isnotempty(DestPublicIPs_s), DestPublicIPs_s, "N/A")

示例 2:NSGRules_s 字段Example 2: NSGRules_s field

旧字段使用以下格式:The old field used the format:

<Index value 0)>|<NSG_ RuleName>|<Flow Direction>|<Flow Status>|<FlowCount ProcessedByRule>

我们不再跨网络安全组 (NSG) 聚合数据。We no longer aggregate data across a network security group (NSG). 在更新后的架构中,NSGList_s 只包含一个 NSG。In the updated schema, NSGList_s contains only one NSG. 此外,NSGRules 也只包含一条规则。Also NSGRules contains only one rule. 如示例中所示,我们删除了此处和其他字段中的复杂格式。We removed the complicated formatting here and in other fields as shown in the example.

AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog" and FASchemaVersion_s == "1"
| extend NSGRuleComponents = split(NSGRules_s, "|")
| extend NSGName = NSGList_s // remains same
| extend NSGRuleName = NSGRuleComponents[1],
         FlowDirection = NSGRuleComponents[2],
         FlowStatus = NSGRuleComponents[3],
         FlowCountProcessedByRule = NSGRuleComponents[4]
| project NSGName, NSGRuleName, FlowDirection, FlowStatus, FlowCountProcessedByRule
AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog" and FASchemaVersion_s == "2"
| extend NSGRuleComponents = split(NSGRules_s, "|")
| project NSGName = NSGList_s,
NSGRuleName = NSGRule_s ,
FlowDirection = FlowDirection_s,
FlowStatus = FlowStatus_s,
FlowCountProcessedByRule = AllowedInFlows_d + DeniedInFlows_d + AllowedOutFlows_d + DeniedOutFlows_d

示例 3:FlowCount_d 字段Example 3: FlowCount_d field

因为我们不跨 NSG 聚合数据,所以 FlowCount_d 非常简单:Because we do not club data across the NSG, the FlowCount_d is simply:

AllowedInFlows_d + DeniedInFlows_d + AllowedOutFlows_d + DeniedOutFlows_d AllowedInFlows_d + DeniedInFlows_d + AllowedOutFlows_d + DeniedOutFlows_d

这四个字段中只有一个是非零的。Only one of the four fields will be nonzero. 其他三个字段将为零。The other three fields will be zero. 将填充这些字段以指示捕获流的 NIC 中的状态和计数。The fields populate to indicate the status and count in the NIC where the flow was captured.

为了说明这些条件:To illustrate these conditions:

  • 如果允许该流,则填充一个前缀为“Allowed”的字段。If the flow was allowed, one of the "Allowed" prefixed fields will be populated.
  • 如果拒绝该流,则填充一个前缀为“Denied”的字段。If the flow was denied, one of the "Denied" prefixed fields will be populated.
  • 如果流是入站流,则填充一个后缀为“InFlows_d”的字段。If the flow was inbound, one of the "InFlows_d" suffixed fields will be populated.
  • 如果流是出站流,则填充一个后缀为“OutFlows_d”的字段。If the flow was outbound, one of the "OutFlows_d" suffixed fields will be populated.

根据上述条件,我们知道需要填充四个字段中的哪一个。Depending on the conditions, we know which one of the four fields will be populated.

后续步骤Next steps