Your company is deploying Azure Virtual Network flow logs to capture IP traffic across a production environment. The VNet named prod-vnet contains six subnets, each with its own NSG. The security team wants a single flow log configuration that automatically captures traffic for every subnet, including any new subnets added later, without configuring logs per NSG. Which target resource should you select when creating the flow log?