azure_analyze_nsg_rules
Analyzes Azure NSG rules to identify open management ports, overly permissive rules, and validates service endpoints and load balancer associations for security misconfigurations.
Instructions
ENHANCED v1.14.0 Automated Network Security Group (NSG) security analysis with service endpoints and load balancer integration validation. Identifies: open management ports (RDP 3389, SSH 22, WinRM 5985/5986), database ports (SQL 1433, MySQL 3306, PostgreSQL 5432, MongoDB 27017), wildcard source rules (0.0.0.0/0, Internet, Any), overly permissive rules, service endpoint security, load balancer backend pool NSG associations. Returns findings with risk severity and remediation recommendations.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| subscriptionId | Yes | Azure subscription ID | |
| resourceGroup | No | Optional: Filter by specific resource group | |
| nsgName | No | Optional: Analyze specific NSG by name | |
| validateServiceEndpoints | No | Validate service endpoints security (checks if NSGs allow access to Azure Storage, SQL, etc.). Default: true | |
| checkLoadBalancers | No | Check NSG associations with load balancer backend pools for security misconfigurations. Default: true | |
| format | No | Output format: 'markdown' (default, human-readable) or 'json' (machine-readable) |