A virtual machine named VM1 in Azure cannot receive inbound HTTPS (TCP 443) traffic from a specific client IP address on the internet. You need to quickly determine whether an NSG rule is allowing or denying this specific traffic to VM1's network interface, and which rule is responsible, without inspecting every rule manually. Which Network Watcher feature should you use?