azure-security-audit

name	azure-security-audit
description	Azure NSG compliance auditing and security posture assessment. CIS Azure Foundations Benchmark rules, effective security rule analysis, orphaned NSG detection. Use when auditing Azure NSGs for CIS compliance, checking for overly permissive rules, or reviewing effective security on NICs.
version	1.0.0
license	Apache-2.0
tags	["azure","nsg","security","compliance","cis-benchmark","audit"]

Azure Security Audit

MCP Server

• Server: azure-network-mcp (shared with azure-network-ops)
• Command: python mcp-servers/azure-network-mcp/azure_network_mcp_server.py (stdio transport)
• Requires: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
• Read-only: All operations are observation-only

Relevant Tools

Primary Audit Tools

Tool	What It Does
azure_audit_nsg_compliance	Run CIS Azure Foundations Benchmark against all or specific NSGs
azure_list_nsgs	List all NSGs with orphan detection (no subnet/NIC associations)
azure_get_nsg_rules	Full rule list sorted by priority for a specific NSG
azure_get_effective_security_rules	Effective aggregated rules on a NIC (all NSGs combined)

Supporting Context Tools

Tool	What It Does
azure_get_network_watcher_status	Flow log configuration and retention checks
azure_get_vnet_details	Subnet-to-NSG associations for VNet topology context
azure_list_firewalls	Azure Firewall policies for layered security context

CIS Azure Foundations Benchmark Rules

The compliance audit checks these rules from the CIS Azure Foundations Benchmark:

Rule	Severity	What It Checks
6.1	Critical	RDP (port 3389) not open to 0.0.0.0/0 from internet
6.2	Critical	SSH (port 22) not open to 0.0.0.0/0 from internet
6.3	High	No unrestricted UDP (all ports) from internet
6.4	Medium	NSG flow logs enabled with >= 90 day retention

Workflow: Full NSG Compliance Audit

When asked "audit NSG compliance" or "check Azure security posture":

1. Discover: azure_list_nsgs -- get all NSGs, note orphaned ones
2. Audit: azure_audit_nsg_compliance -- run CIS checks against all NSGs
3. Deep dive: For each Critical/High finding:
   • azure_get_nsg_rules -- review the full rule set for context
   • Identify which subnets/NICs are affected via associations
4. Effective rules: For critical NICs:
   • azure_get_effective_security_rules -- verify aggregated effective rules
5. Flow logs: azure_get_network_watcher_status -- check flow log coverage
6. Report: Summarize by severity, list affected resources, provide remediation steps

Workflow: Incident Response -- Suspicious Access

When investigating a potential security incident:

1. azure_get_effective_security_rules for the target NIC -- what traffic is allowed?
2. azure_get_nsg_rules for each associated NSG -- which specific rules permit traffic?
3. azure_audit_nsg_compliance on the specific NSG -- any known compliance gaps?
4. azure_get_network_watcher_status -- check if flow logs captured the traffic
5. Cross-reference with azure-network-ops VNet tools for full topology context

Integration with azure-network-ops

This skill uses tools from the same azure-network-mcp server as azure-network-ops. The skills are complementary:

• azure-network-ops: Broad network topology, connectivity, and health monitoring
• azure-security-audit: Focused NSG compliance, security rule analysis, and posture assessment

Use both together for a complete Azure networking and security picture.

Important Rules

• Read-only: Never modify NSG rules, flow logs, or any Azure resources
• Severity prioritization: Always report Critical findings first, then High, Medium, Low
• Remediation guidance: Include specific remediation steps for every finding
• GAIT logging: All audit operations are logged for compliance trail
• Subscription scope: Audit can cover all NSGs or filter by specific NSG/resource group