Traffic Analytics

In the Ultra Transcenders books

AZ-305AZ-104AZ-700

Each book explains Traffic Analytics in context, with comparison tables and the common traps.

Terms in this definition

• Default security rules

  Built-in NSG rules at priorities 65000-65500: AllowVnetInBound, AllowAzureLoadBalancerInBound and DenyAllInBound, plus AllowVnetOutBound, AllowInternetOutBound and DenyAllOutBound. Removal is impossible; custom rules at 100-4096 take precedence.

• Virtual network flow logs

  Replacing NSG flow logs, these Network Watcher logs are switched on at the VNet and capture traffic per flow rather than per packet, storing it in a storage account for Traffic Analytics to use.

• Network Watcher

  Collection of Azure network troubleshooting tools: next hop, IP flow verify, packet capture, Connection Monitor and flow logs, among others.

• Scope

  Where an access or policy assignment takes effect. It can be set on a single resource, a resource group, a subscription or a management group, and settings flow down from higher levels.

Related terms

• AzureNetworkAnalytics_CL

  Table in Log Analytics populated by Traffic Analytics with processed NSG flow log results; each field name ends with a type suffix, for example FlowType_s, SubType_s or FlowStartTime_t.

• ExternalPublic

  Traffic Analytics label for flows between Azure VMs and public IPs owned by neither Microsoft nor a known attacker. Query it with FlowType_s == "ExternalPublic" (in NTANetAnalytics, use FlowType).

• Microsoft.OperationalInsights

  Namespace under which Azure registers Log Analytics workspace resources. Features such as Traffic Analytics depend on two of its actions: workspaces/read and workspaces/sharedkeys/action.

• Network Contributor

  Built-in role that manages networking resources through Microsoft.Network/*. Flow logs and Traffic Analytics also need storage, Log Analytics workspace and DCR actions, which this role does not include.

• NTANetAnalytics

  Table in Log Analytics that receives Traffic Analytics output for virtual network flow logs, superseding AzureNetworkAnalytics_CL. Its field names carry no type suffix, for example FlowType.

• Traffic Manager Contributor

  A built-in role whose permissions cover only managing Traffic Manager profiles; turning on Traffic Analytics is beyond it.