Capture traffic using Virtual Network TAP, deploy sensor VM with Bicep, and bridge network telemetry into the security platform. الجمهور: Platform engineers, Azure administrators, security engineers. وقت الإعداد المعتاد: 15 minutes.
Capture traffic using Virtual Network TAP, deploy sensor VM with Bicep, and bridge network telemetry into the security platform.
انسخ إعداد البداية وقم بتشغيله في بيئتك، ثم عد إلى هنا للحصول على تفاصيل التوزيع الأكثر عمقًا.
Demonstration only
This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.
Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.
Creates the Azure Bicep template under `deploy/azure-network-sensor/` with the current platform API URL prefilled for VNet TAP-based network telemetry ingestion.
BLACKSHIELD_NETWORK_SENSOR_IMAGE=public.ecr.aws/blackshield-security/network-sensor:1.0.11 \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/azure-network-sensor.sh)
cd deploy/azure-network-sensor#!/bin/bash
# Complete Azure Virtual Network TAP setup script
RESOURCE_GROUP="my-prod-rg"
LOCATION="eastus"
TAP_NAME="network-sensor-tap"
SENSOR_NIC_IPCONFIG_ID="/subscriptions/.../resourceGroups/my-prod-rg/providers/Microsoft.Network/networkInterfaces/sensor-nic/ipConfigurations/ipconfig1"
SOURCE_NIC="prod-workload-nic"
echo "1. Creating Virtual Network TAP..."
az network vnet tap create \
--resource-group "$RESOURCE_GROUP" \
--name "$TAP_NAME" \
--location "$LOCATION" \
--destination "$SENSOR_NIC_IPCONFIG_ID" \
--port 4789
echo "2. Retrieving TAP ID..."
TAP_ID=$(az network vnet tap show \
--resource-group "$RESOURCE_GROUP" \
--name "$TAP_NAME" \
--query id -o tsv)
echo "3. Attaching TAP to the Source VM NIC..."
az network nic vtap-config create \
--resource-group "$RESOURCE_GROUP" \
--nic-name "$SOURCE_NIC" \
--name "Mirror-To-Sensor" \
--vnet-tap "$TAP_ID"
echo "Success! VNet TAP attached to $SOURCE_NIC."# 1. Set variables
RESOURCE_GROUP="my-prod-rg"
SUBNET_ID="/subscriptions/.../resourceGroups/.../providers/Microsoft.Network/virtualNetworks/.../subnets/default"
# 2. Deploy Infrastructure
cd deploy/azure-network-sensor
az deployment group create \
--resource-group "$RESOURCE_GROUP" \
--template-file main.bicep \
--parameters subnetId="$SUBNET_ID" apiKey="sp_your_ingestion_key"// Azure Bicep snippet for Network Sensor Deployment
param location string = resourceGroup().location
param subnetId string
@secure()
param apiKey string
resource sensorNic 'Microsoft.Network/networkInterfaces@2023-04-01' = {
name: 'network-sensor-nic'
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
subnet: { id: subnetId }
privateIPAllocationMethod: 'Dynamic'
}
}
]
}
}
resource sensorVm 'Microsoft.Compute/virtualMachines@2023-03-01' = {
name: 'blackshield-network-sensor'
location: location
properties: {
hardwareProfile: { vmSize: 'Standard_D2s_v5' }
osProfile: {
computerName: 'networksensor'
adminUsername: 'azureuser'
linuxConfiguration: { disablePasswordAuthentication: true }
}
storageProfile: {
imageReference: {
publisher: 'Canonical'
offer: '0001-com-ubuntu-server-jammy'
sku: '22_04-lts-gen2'
version: 'latest'
}
}
networkProfile: {
networkInterfaces: [ { id: sensorNic.id } ]
}
}
}
// Extension to run the sensor container
resource vmExtension 'Microsoft.Compute/virtualMachines/extensions@2023-03-01' = {
parent: sensorVm
name: 'install-sensor'
location: location
properties: {
publisher: 'Microsoft.Azure.Extensions'
type: 'CustomScript'
typeHandlerVersion: '2.1'
autoUpgradeMinorVersion: true
settings: {
commandToExecute: 'apt-get update && apt-get install -y docker.io && docker run -d --net host -e BLACKSHIELD_API_KEY=${apiKey} -e BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com public.ecr.aws/blackshield-security/network-sensor:1.0.11'
}
}
}استخدم الخطوات الإرشادية أدناه عندما ترغب في تخصيص التوزيع أو التحقق من الملكية أو توسيع النشر بأمان.
الخطوة 1
Use the provided Bicep template to deploy the sensor VM. This acts as the destination for your mirrored traffic. The template configures the required Network Security Group (NSG) rules for VXLAN.
معايير النجاح
Note the generated VM's Network Interface (NIC) ID from the deployment output — you'll need this to set up the VNet TAP destination.
الخطوة 2
Set up an Azure VNet TAP to duplicate traffic from your production VMs and route it to the sensor instance.
معايير النجاح
Verify the VNet TAP status is 'Connected' in the Azure portal or via CLI.
سياق مفيد
الخطوة 3
Confirm the sensor container is running properly on your VM and receiving the mirrored VXLAN traffic.
معايير النجاح
Check the platform Findings view to see network-based alerts within 5 minutes of traffic flowing on the mirrored interfaces.
Keep your rollout moving with the next recommended step.
مراجعة النتائج وتحديد الأولويات