6.1.3. Flow Logs and Diagnostics

NSG Flow Logs: Log all traffic through an NSG—allowed and denied.

Log Levels:

• Version 1: Basic 5-tuple + action
• Version 2: + Bytes, packets, flow state

VNet Flow Logs: Log traffic at VNet level (all subnets), not just NSG evaluation points.

Traffic Analytics: Transform flow logs into visualizations:

• Top talkers
• Traffic patterns over time
• Blocked traffic analysis
• Geo-location of flows

IP Flow Verify: Test if a specific flow would be allowed:

Test: Can 10.0.1.5 reach 10.0.2.10 on TCP 443?
Result: Allowed by rule "AllowHTTPS" in NSG "web-nsg"