NSG Flow Logs + Traffic Analytics

RG="rg-az500-flowlogs-lab22"

# Đăng ký provider (nếu chưa)
az provider register --namespace Microsoft.Network
az provider register --namespace Microsoft.Insights

# Bật Network Watcher tại southeastasia
az network watcher configure \
  --resource-group NetworkWatcherRG \
  --locations southeastasia \
  --enabled true

# Tạo resource group
az group create --name $RG --location southeastasia \
  --tags "owner=hoatranlab" "env=lab" "module=az500-ch05"

# VNet + subnet
az network vnet create \
  --resource-group $RG \
  --name vnet-az500-lab22 \
  --address-prefix 10.22.0.0/16 \
  --subnet-name snet-app \
  --subnet-prefix 10.22.1.0/24

# Tạo NSG với rule SSH allow từ any (để tạo traffic test)
az network nsg create \
  --resource-group $RG \
  --name nsg-az500-lab22 \
  --location southeastasia

az network nsg rule create \
  --resource-group $RG --nsg-name nsg-az500-lab22 \
  --name Allow-SSH --priority 100 \
  --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes "*" --destination-port-ranges 22

az network vnet subnet update \
  --resource-group $RG --vnet-name vnet-az500-lab22 \
  --name snet-app --network-security-group nsg-az500-lab22

# Tạo VM để sinh traffic
az network public-ip create --resource-group $RG --name pip-vm-lab22 --sku Standard --allocation-method Static
az network nic create --resource-group $RG --name nic-vm-lab22 \
  --vnet-name vnet-az500-lab22 --subnet snet-app --public-ip-address pip-vm-lab22
az vm create --resource-group $RG --name vm-az500-lab22 \
  --nics nic-vm-lab22 --image Ubuntu2204 --size Standard_B1s \
  --admin-username azureadmin --generate-ssh-keys --no-wait

RG="rg-az500-flowlogs-lab22"
# Suffix ngẫu nhiên để tên storage unique
SUFFIX=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 6 | head -n 1)
SA_NAME="staz500flowlogs${SUFFIX}"
echo "Storage name: $SA_NAME"

# Tạo Storage Account với minimum TLS 1.2 (bắt buộc 2026)
az storage account create \
  --resource-group $RG \
  --name $SA_NAME \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --https-only true

# Tạo Log Analytics Workspace cho Traffic Analytics
az monitor log-analytics workspace create \
  --resource-group $RG \
  --workspace-name law-az500-lab22 \
  --location southeastasia \
  --sku PerGB2018 \
  --retention-time 30

# Lấy workspace ID và key
LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group $RG --workspace-name law-az500-lab22 \
  --query customerId -o tsv)
echo "Log Analytics Workspace ID: $LAW_ID"

RG="rg-az500-flowlogs-lab22"
SA_NAME="staz500flowlogs[suffix]"   # thay bằng tên thực

# Lấy IDs cần thiết
NSG_ID=$(az network nsg show --resource-group $RG \
  --name nsg-az500-lab22 --query id -o tsv)
SA_ID=$(az storage account show --resource-group $RG \
  --name $SA_NAME --query id -o tsv)
LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group $RG --workspace-name law-az500-lab22 \
  --query id -o tsv)

# Bật NSG Flow Logs version 2 với Traffic Analytics
az network watcher flow-log create \
  --resource-group NetworkWatcherRG \
  --name flowlog-nsg-lab22 \
  --nsg $NSG_ID \
  --storage-account $SA_ID \
  --enabled true \
  --retention 7 \
  --format JSON \
  --log-version 2 \
  --traffic-analytics true \
  --workspace $LAW_ID \
  --interval 10 \
  --location southeastasia

# Xác nhận flow log được bật
az network watcher flow-log show \
  --resource-group NetworkWatcherRG \
  --name flowlog-nsg-lab22 \
  --query "{Enabled:enabled,Version:format.version,RetentionDays:retentionPolicy.days,TrafficAnalytics:flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled}" \
  --output table

RG="rg-az500-flowlogs-lab22"
SA_NAME="staz500flowlogs[suffix]"

# Lấy VM public IP
VM_PIP=$(az network public-ip show \
  --resource-group $RG --name pip-vm-lab22 --query ipAddress -o tsv)
echo "VM Public IP: $VM_PIP"

# Sinh traffic: SSH thử kết nối (tạo Allow flow)
ssh -o ConnectTimeout=5 azureadmin@$VM_PIP "echo 'traffic test ok'" 2>/dev/null || true

# Sinh denied traffic: thử cổng bị chặn
nc -z -w 3 $VM_PIP 8080 2>/dev/null || echo "Port 8080 denied (expected)"
nc -z -w 3 $VM_PIP 3389 2>/dev/null || echo "Port 3389 denied (expected)"

# Chờ 5-10 phút, sau đó liệt kê blobs trong container flow logs
az storage blob list \
  --account-name $SA_NAME \
  --container-name "insights-logs-networksecuritygroupflowevent" \
  --output table \
  --auth-mode login 2>/dev/null | head -20