List of Azure resource network interface cards

Data required

Microsoft: Cloud Services network data

​​​​​Procedure

1. Configure the Splunk Add-on for Microsoft Cloud Services.
2. Run the following search. You can optimize it by specifying an index and adjusting the time range.

sourcetype="mscs:resource:networkInterfaceCard"
|rex field=virtual_network_id "virtualNetworks\/(?<Network>.+)" 
|rex field=vm_id "virtualMachines\/(?<vm>.+)"  
|stats count BY location, name, properties.ipConfigurations{}.properties.privateIPAddress, properties.ipConfigurations{}.properties.privateIPAllocationMethod, Network, vm 
|fields - count
|rename location AS Location name AS NIC properties.ipConfigurations{}.properties.privateIPAddress AS "Private IP" properties.ipConfigurations{}.properties.privateIPAllocationMethod AS "Allocation Method" Network AS "Source Network" vm AS "Source VM"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Next steps

Sample results for this search are shown in the table below. The results show all network interface cards provisioned in the environment, including the name of the virtual machine (VM) that the NIC is contained within. This data could be the foundation for asset management data collection. Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management. 

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.