Use Network Watcher and Azure Functions to process VM alerts and intiate a packet capture
In this sample we show how you can programmatically initiate a packet capture using Network Watcher and Azure Functions. This sample utilizes the Azure Management Libraries for .NET
Deploy the Azure Function using an ARM template
The AlertPacketCapture branch contains a working version of the deployment template, tailored for a real version of a function that processes Azure Monitor Alerts and triggers a subsequent packet capture on the resource that fired the alert.
The steps to fully implement the Azure Network Watcher Alert Packet Capture Connector are:
* Gather the settings below - the function requires a service principle in order to authenticate to Azure Resource Manager(ARM). * Click the "Deploy to Azure" button below. * Authenticate to the Azure Portal (if necessary) * Fill in the form with the setting values * Wait a few minutes for the function to be created and deployed * Configure Alerts on the appropriate VM resource and provide the URL of the the function. Example
- AppName - this is the name of the function app. In the Azure Portal, this is the name that will appear in the list of resources.
- appServicePlanTier - "Free", "Shared", "Basic", "Standard", "Premium", "PremiumV2"
- appServicePlanName - depends on tier, for full details see "Choose your pricing tier" in the portal on an App service plan "Scale up" applet.
Example: For standard tier, "S1", "S2", "S3" are options for plan name
- appServicePlanCapacity - how many instances do you want to set for the upper limit?
Example: For standard tier, S2, set a value from 1 to 10
- githubRepoURL - this is the URL of the repo that contains the function app source. You would put your fork's address here.
- githubRepoBranch - this is the name of the branch containing the code you want to deploy.
- PacketCaptureStorageAccount - this is the name of the storage account where packet captures will be saved
- ClientId - this is the clientId of the Service Principle used to authenticate to Azure Resource Manager
- ClientKey - this is the client key associated with the service princple
- TenantId - this is the Azure Active Directory TenantId