Azure Flow Logs

⚠️

Previously known as NSG Flow logs, Microsoft deprecated NSG flow logs on June 30, 2025 and plans to retire them on September 30, 2027. In order to migrate to the new Azure Flow (also known as Virtual Net Flow) logs please follow Microsoft’s documentation for migration, https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate.

Virtual net flow logs control inbound and outbound traffic to and from Azure resources by defining security rules based on IP address, port, and protocol. Virtual net flow logs capture information about network traffic, including source and destination IP addresses, ports, protocols, and whether traffic was allowed or denied. These logs are useful for monitoring network traffic, troubleshooting connectivity issues, and enhancing network security by detecting suspicious or unauthorized traffic patterns.

Ingest Method

Setup the ingestion of this source using the following guide.

Azure Blob Storage

Virtual Net Flow Log Forwarding

With the storage account created you can now setup Virtual net flow logs to export to it.

Follow along with Microsoft’s documentation on the exact steps required to create a new flow log. https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage?tabs=portal#create-a-flow-log

RunReveal Source

Go to RunReveal and add a new source selecting Azure Flow Logs.

Give the source a name and fill in the remaining fields with the saved values from setup.

azure blob

You will need the values that were saved from the setup steps.

  • The app Tenant ID and Client ID from the app registration screen.
  • The Client Secret Value that was created when generating a new secret for the app.
  • The Storage Account Name where the logs are exporting to.
  • The Storage Queue Name that holds the blob created notifications.

Once these are supplied and saved, RunReveal will begin to process messages in the queue and then ingest logs stored in the bucket.

Because of how Microsoft exports flow logs to storage accounts, logs are usually delayed until the top of the next hour.