Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Network Security Group (NSG) flow logs record information about IP traffic that passes through an NSG. The logs are written in JSON format and include the source and destination IP addresses, ports, protocol, the network interface (NIC) involved, and whether the traffic was allowed or denied. Azure Network Watcher enables these logs by associating an NSG with a diagnostic setting and directing the output to a storage account or a Log Analytics workspace. Once enabled, the logs capture outbound and inbound flows on a per-rule basis, the NIC ID, the flow status (allowed or denied), and protocol and port details. This data gives a high-level view of traffic volumes and which rules are being hit, helping you identify which connections are succeeding and which are being blocked.
Packet capture sessions let you collect raw network traffic for deeper, packet-by-packet inspection. To configure a packet capture, you need an Azure subscription with Network Watcher enabled, a virtual machine or VM scale set that has the Network Watcher agent extension installed, and a storage account accessible from the VM’s subnet to store the capture files. You can start a packet capture in the Azure portal, Azure CLI, or PowerShell. Typical steps include selecting Network Watcher > Packet capture > + Add, specifying the target VM, a capture name, the storage location (storage account or local file), and defining filters such as IP address, port, or protocol, along with optional time limits. The capture runs on the VM and writes the raw packets to the specified destination.
After collecting NSG flow logs and packet captures, you analyze them together to detect unauthorized connections and anomalous traffic patterns. NSG flow logs provide a broad overview of traffic flows and rule effectiveness, while packet captures offer granular details about individual packets, such as payload contents and exact timing. Integrate these insights with Azure Monitor or Traffic Analytics for continuous threat detection and faster incident response. Traffic Analytics, for example, can visualize flow log data and highlight suspicious patterns, while packet captures can be used to confirm a breach or investigate a specific alert. This combined approach allows you to move from a high-level understanding of network behavior to a precise forensic analysis when needed.
Prepare and test your skills
Prepare and test your skills
Network Security Group (NSG) flow logs record information about IP traffic passing through an NSG in JSON format. They capture inbound and outbound flows on a per-rule basis, including source and destination IP addresses, ports, protocol, network interface ID, and whether traffic was allowed or denied.
To configure a packet capture, you need an Azure subscription with Azure Network Watcher enabled, a target virtual machine or VM scale set with the Network Watcher agent extension installed, and a storage account accessible from the virtual machine subnet to store the capture files. Captures can then be initiated through the Azure portal, Azure CLI, or PowerShell.
NSG flow logs provide a broad overview of traffic flows, rule effectiveness, and traffic volumes by recording whether connections are allowed or blocked. Packet captures provide granular, packet-by-packet inspection of raw network traffic, including exact timing and payload contents for forensic analysis and alert confirmation.
StudyCerts
StudyCerts