How to monitor network traffic/IP coming in an azure network which are blocked by NSG through Virtual network Flow Logs

As per https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema?tabs=vnet

NTANetAnalytics in virtual network flow logs replaces AzureNetworkAnalytics_CL used in network security group flow logs.

The easiest way to locate the right table is to open Log Analytics, type just a single letter (e.g., “N”) in the query window, expand the schema list on the left, and look for tables that started being populated right after you enabled the new flow logs. You will see rows filling in every few minutes. Those are your flow-log tables.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Hi @ishan saxena,

Thanks for reaching out on Microsoft Q&A forum.

I understand you're trying to query blocked NSG traffic using the new Virtual Network Flow Logs, but you're seeing this error:'where' operator: Failed to resolve table or column expression named 'AzureNetworkAnalytics_CL'

This happens because that table belongs to the retired NSG Flow Logs / Traffic Analytics pipeline. With Virtual network flow logs, the data is stored in different Log Analytics tables.

• AzureNetworkAnalytics_CL is from legacy NSG Flow Logs (v1/v2)
• This table was created by the old Traffic Analytics solution tied to NSG Flow Logs v2.
  Since NSG Flow Logs are being retired, the table is no longer populated-https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate

As mentioned by @Marcin Policht,The new Virtual Network Flow Logs write to new tables:

• NTANetAnalytics — flow records-[ https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/ntanetanalytics]
• NTAIpDetails — IP metadata, threat info-[ https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/ntaipdetails]

Because of this, Microsoft requires all customers to use Virtual Network Flow Logs + Traffic Analytics going forward.

So, enable Traffic Analytics on your Virtual Network Flow Log and query these new tables in Log Analytics and then you will be able to view the logs.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".