Question

Your organization runs 40 virtual networks across three Azure regions. The security team wants a single, future-proof solution to capture Layer 4 traffic metadata for all current and future subnets and VMs, with minimal ongoing administrative effort as new subnets are added. They also want the data enriched with geo-location and threat intelligence for analysis. Microsoft has announced the retirement of NSG flow logs. Which approach should you implement?

Accepted Answer

Enable virtual network flow logs at the virtual network level and integrate them with Traffic Analytics.

Answer

Enable NSG flow logs on every existing NSG and create an Azure Policy to auto-enable flow logs on any newly created NSG, then connect them to Traffic Analytics.

Answer

Enable IP flow verify for each VM on a recurring schedule and export the results to a Log Analytics workspace.

Answer

Enable packet capture in Network Watcher on all VMs and store the captures in a storage account for analysis.