This is a collection of scripts for working with Azure flow logs. Currently includes a script that restructures the deeply nested, event-driven JSON Azure NSG logs into a more analyst-friendly mode (eliminate fixed-value, redudant, and structural fields, flatten structure, and unpack composite fields). The script is structured as three successive transformations on the data: flattening, simplifying, and consolidating. The flattening transform collapses unnecessary nesting, making access to fields more direct during an analysis. The simplifying transform removes fields irrelevant to cybersecurity or that are redundant. This transform reduces the processing and storage requirements associated with the data.
