Network Effective

network-effective

network-effective is the combined network view that tries to show which assets are probably most reachable after visible Azure network layers are considered together.

Use it when you need a joined network picture instead of reasoning about endpoints, NICs, and inbound rules in isolation.

What This Command Answers

• Which assets are probably most reachable after visible Azure network layers are combined?
• Which reachable-looking asset deserves follow-up first?
• Which network story is strongest without over-claiming certainty?

Run It

azurefox network-effective --output table

For saved structured output:

azurefox network-effective --output json

Example Table Output

asset	endpoint	priority	internet ports	narrower ports
vm-web-01	52.160.10.20	high	TCP/22	TCP/443, TCP/8080

When To Use It

• when you want the combined network picture instead of manual stitching
• after endpoints, nics, or network-ports suggest several possible exposure paths
• when you need a more honest reachability ranking than any one source table can provide

What To Look For

• assets whose combined visible network story is strongest
• externally relevant endpoints and public-IP-linked placement
• matching or permissive inbound rule posture
• clear explanation of what evidence raised the asset and where confidence is limited

Why It Matters

Single network clues are easy to over-read.

A scary-looking rule may matter less once the broader network picture is considered, and a quiet asset may matter more once several visible layers line up. network-effective is useful because it helps you reason about that combined picture without pretending AzureFox has certainty it does not have.

What Should Stand Out First

• the assets with the clearest combined ingress story
• endpoint, NIC, and inbound-rule evidence that lines up cleanly
• explicit confidence or limitation cues
• the workloads that become priority once several network layers point the same way

If You See..., Go Next To...

• If you see effective_exposure=high with internet_exposed_ports, go next to Network-Ports because it shows the exact inbound rule evidence behind that exposure ranking.
• If the exposed asset also carries identity context, go next to Managed-Identities because it answers whether that reachable asset is also an Azure token path.
• If the exposed asset is a joined workload you want to prioritize against peers, go next to workloads because it shows the broader workload and identity story behind the reachable asset.

What To Do Next

• Use this command to choose the first network path worth validating, not to declare final proof.
• Pair its ranking with the underlying endpoint and rule evidence before making stronger claims.
• Treat clear limitation cues as part of the result, not an inconvenience to ignore.

Boundary

network-effective is a routing and synthesis command.

It should combine visible network evidence into a more usable priority view. It is not real listener proof or certainty theater.