Using Traffic Analytics

In the previous chapter, we covered recipes for effectively using Microsoft Sentinel.

In this chapter, you will learn how to collect NSG flow logs from virtual machines (VMs) to monitor and analyze network traffic.

By the end of this chapter, you will have learned the skills required to carry out the following recipe in secure Azure AD:

• Implementing traffic analytics

Technical requirements

This chapter assumes that you have an Azure AD tenancy and an Azure subscription from completing the recipes in previous chapters of this cookbook. If you skipped straight to this section, the information needed to create a new Azure AD tenancy and an Azure subscription for these recipes is included in the following list of requirements.

For this chapter, the following are required:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• An Azure AD tenancy and Azure subscription; you may use existing or sign up for free: https://azure.microsoft.com/en-us/free
• An Owner role for the Azure subscription

Terminology reference

We will start with some of the terminology used in traffic analytics:

• Network security group (NSG): This controls network traffic flow into and out of a VM via a network interface
• NSG flow logs: We can capture information about every packet that flows into...

Implementing traffic analytics

Traffic analytics provides rich visual representations of network packet information made available by NSG flow logs. The NSG flow logs capture network traffic information, such as IP address source and destination, and the packet’s port and protocol used.

This recipe will teach you how to implement traffic analytics with NSG flow logs.

Getting ready

This recipe requires the following to be in place:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• Access to an Azure subscription, where you have access to the Owner role
• A Windows Server Azure VM with an NSG to use with this recipe; we will step through creating this VM and NSG as a getting-ready task

Continue with the following getting-ready tasks for this recipe:

• Creating a VM
• Creating a Log Analytics workspace

A getting-ready task – creating a VM

Perform the following steps:

...