A network engineer needs to retroactively analyze which VM traffic was allowed and denied over the past week to investigate a suspected data exfiltration incident. The team needs aggregated records of flows (5-tuple, allow/deny decision, bytes, and packets) that can be queried later, not a point-in-time test. Which Azure networking feature should the engineer use?