Azure Zero Trust Network Visualizer & Analyzer

Visualize Azure VNet topology, analyze NSG/Firewall rules, detect Zero Trust segmentation gaps, and generate remediation rules — directly in VS Code.

Features

Network Topology Visualization

• Interactive topology map — visualizes VNets, subnets, peerings, firewalls, and private endpoints as an interactive network graph
• Automatic classification — detects hub-spoke, mesh, flat, or isolated topologies
• Color-coded nodes — red for critical issues, amber for warnings, green for healthy resources
• Security finding badges — each node shows its finding count at a glance

NSG Rule Effectiveness Matrix

• Port exposure table — shows which critical ports (SSH, RDP, SQL, Redis, etc.) are allowed or denied per NSG
• Any-source detection — flags rules allowing traffic from 0.0.0.0/0 (★ ANY)
• Visual heat-map — red for allowed, green for denied, across all critical ports

Azure Firewall Policy Analyzer

• Threat intelligence mode check — flags firewalls with threat intel disabled
• Permissive rule detection — identifies rules with wildcard source/destination
• Rule collection analysis — counts and evaluates NAT, network, and application rule collections

Private Endpoint Connectivity Map

• Endpoint inventory — shows all private endpoints with their service type and connection state
• Connectivity state — highlights disconnected or pending private endpoints
• Subnet mapping — traces each endpoint to its owning VNet/subnet

Zero Trust Segmentation Gap Detection

• Flat network detection — flags architectures without segmentation
• Missing NSG analysis — identifies subnets without Network Security Groups
• Insecure peering — detects peerings that allow transit without firewall inspection
• Missing route tables — flags subnets without user-defined routes
• Service endpoint gaps — identifies subnets missing key service endpoints

Remediation Rule Generation

• NSG deny rules — generates inbound deny rules for exposed management ports
• Bicep IaC snippets — produces infrastructure-as-code for each remediation
• Azure CLI commands — one-click CLI scripts to apply fixes
• Impact assessment — each remediation rated as low, medium, or high impact

Security Posture Scoring

• Five category scores: Network Segmentation (25), NSG Configuration (25), Firewall Protection (20), Private Connectivity (15), Monitoring & Logging (15)
• Overall grade: A through F based on composite percentage
• Status bar indicator: live posture grade with finding counts in the VS Code status bar

Requirements

• VS Code 1.85.0 or later
• Azure subscription with Reader access to network resources
• Azure CLI or environment with Azure credentials configured (supports DefaultAzureCredential)
• Required RBAC roles: Reader on subscription or resource groups. For remediation application: Network Contributor

Getting Started

1. Install the extension
2. Open the Command Palette (Ctrl+Shift+P) and run Zero Trust: Connect to Azure Subscription
3. Enter your Azure Subscription ID (or configure it in settings)
4. The extension fetches your network topology and runs Zero Trust analysis automatically
5. Explore the Network Topology and Security Findings panels in the Activity Bar sidebar

Commands

Extension Settings

Architecture

src/
├── extension.ts                     # Entry point — command registration, lifecycle
├── common/
│   ├── types.ts                     # All interfaces: VNet, NSG, Firewall, Findings, Posture
│   ├── azure-network-client.ts      # ARM REST API client for network resources
│   ├── zero-trust-analyzer.ts       # Analysis engine with posture scoring
│   └── remediation-generator.ts     # NSG/Bicep/CLI remediation output
└── views/
    ├── tree-providers.ts            # Sidebar tree views (topology + findings)
    ├── topology-panel.ts            # Interactive topology map webview
    ├── analysis-dashboard.ts        # Posture dashboard with NSG matrix
    └── status-bar-manager.ts        # Status bar posture indicator

Security Findings Categories

Exported Report Format

The JSON report includes:

{
  "generatedAt": "2024-01-15T12:00:00.000Z",
  "overallGrade": "B",
  "overallScore": 78,
  "summary": "3 high-severity finding(s) detected",
  "categoryScores": [...],
  "topologyType": "hub-spoke",
  "vnetCount": 4,
  "nsgCount": 8,
  "firewallCount": 1,
  "privateEndpointCount": 12,
  "findings": [...],
  "remediations": [...]
}

License

MIT