Azure network security groups

Athena can block attacking addresses in an Azure network security group (NSG) from an alert, a policy rule or Pallas. It keeps its own deny rules in the NSG you name and never changes any other rule:

Rule	Direction	What it denies
Athena-Block-In-1	Inbound	Any protocol and port from the blocked addresses
Athena-Block-Out-1	Outbound	Any protocol and port to the blocked addresses

The rules are created with the first block and removed when the last address is unblocked. Past 1,000 addresses Athena adds -2, -3 ... at the next priorities; it keeps at most 6,000, Azure's limit for one NSG (which your own rules share).

Single IPv4 addresses only for now. The NSG blocks traffic only for the subnets and network interfaces it is attached to.

In Azure

1. The NSG. Use the NSG attached to the subnet (or network interfaces) you want to protect. Choose a priority for Athena's rules that is lower than your allow rules (lower numbers are evaluated first) and free in both directions, together with the five numbers after it: the default is 100, so 100 to 105 must be free.

2. App registration. In Microsoft Entra ID → App registrations, register an application (for example athena-nsg). Under Certificates & secrets, create a client secret. Note the Directory (tenant) ID, the Application (client) ID and the secret's Value.

3. Role, on the NSG only. Create a custom role with these permissions and assign it to the app on the NSG itself (Access control (IAM) → Add role assignment on the NSG):

   {
     "Name": "Athena NSG blocking",
     "Actions": [
       "Microsoft.Network/networkSecurityGroups/read",
       "Microsoft.Network/networkSecurityGroups/securityRules/read",
       "Microsoft.Network/networkSecurityGroups/securityRules/write",
       "Microsoft.Network/networkSecurityGroups/securityRules/delete",
       "Microsoft.Network/locations/operations/read"
     ],
     "AssignableScopes": ["/subscriptions/<subscription id>"]
   }

   The built-in Network Contributor role, scoped to the NSG, also works but allows more.

In the console

Admin → Integrations → Azure network security group:

Field	Notes
Tenant id	Directory (tenant) ID
Client id	Application (client) ID
Client secret	The secret's value. Never shown again once saved
Subscription id	Of the NSG
Resource group	Of the NSG
Network security group	Its name
Rule priority	Empty: 100 (100 to 4091)

Values cannot contain spaces, $, #, quotes or backquotes. Azure client secrets can contain ~ and ., which are fine; if one contains another refused character, create a new secret.

Test connection signs in and reads the NSG (nothing is changed), and shows how many addresses Athena's rules hold. Save applies the change within a minute, and the Block dialog then offers Block on Azure network security group.

How a block works

Each block or unblock reads the NSG, works out the new address list and rewrites only Athena's rules, waiting for Azure to finish each change. A rule another change edited at the same moment is read again rather than overwritten. Blocking an address twice changes nothing.