NTANetAnalytics

Traffic Analytics records for Flowlog enriched data.

Table attributes

Attribute Value
Resource types -
Categories Network
Solutions LogManagement
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
AclGroup string Access control list group refers to the network security group associated with the network security group rule name (or) the network group associated with the security admin configuration which allowed or denied the connection.
AclRule string Access control list rule refers to the network security group rule name or the security admin rule name which allowed or denied the connection.
AllowedInFlows long Count of inbound flows that were allowed. This represents the number of flows that shared the same four-tuple inbound to the network interface at which the flow was captured.
AllowedOutFlows long Count of outbound flows that were allowed(Outbound to the network interface at which the flow was captured).
AzureRegion string Azure region locations.
_BilledSize real The record size in bytes
BytesDestToSrc long Represents bytes sent from the destination to the source of the flow.
BytesSrcToDest long Represents bytes sent from the source to the destination of the flow.
CompletedFlows long This is populated with non-zero value when a flow gets a Completed event.
ConnectingVnets string Space separated list of virtual network names.
ConnectionName string Connection Name.
ConnectionType string Type of the connection. Possible values are VNetPeering, VpnGateway, and ExpressRoute.
Country string Two letter country code (ISO 3166-1 alpha-2).
DeniedInFlows long Count of inbound flows that were denied(Inbound to the network interface at which the flow was captured).
DeniedOutFlows long Count of outbound flows that were denied(Outbound to the network interface at which the flow was captured).
DestApplicationGateway string Application gateway associated with the destination IP in the flow.
DestExpressRouteCircuit string Express route circuit associated with the destination IP in the flow.
DestIp string Destination IP address.
DestLoadBalancer string Load balancer associated with the destination IP in the flow.
DestLocalNetworkGateway string Local network gateway associated with the destination IP in the flow.
DestNic string NIC associated with the destination IP in the flow.
DestPort int Destination port.
DestPublicIps string Destination public IP addresses flow information.
DestRegion string Azure region of virtual network/ network interface/ virtual machine to which the destination IP in the flow belongs to.
DestSubnet string Subnet associated with the destination IP in the flow.
DestSubscription string Subscription Id of virtual network/ network interface/ virtual machine to which the destination IP in the flow belongs to.
DestVm string Virtual machine associated with the destination IP in the flow.
ExpressRouteCircuitPeeringType string The peering type of the associated express route circuit for the flow.
FaSchemaVersion string Schema version for ingestion.
FlowDirection string Direction of the flow which can be inbound or outbound.
FlowEncryption string The type of flow encryption.
FlowEndTime datetime Last occurrence of the flow (which will get aggregated) in the flow log processing interval between "FlowIntervalStartTime_t" and "FlowIntervalEndTime_t". In terms of flow log v2, this field contains the time when the last flow with the same four-tuple started (marked as "B" in the raw flow record).
FlowIntervalEndTime datetime Ending time(in UTC) of the flow log processing interval.
FlowIntervalStartTime datetime Starting time(in UTC) of the flow log processing interval. This is time from which flow interval is measured.
FlowLogResourceId string The resource Id for the flow log
FlowStartTime datetime First occurrence of the flow (which will get aggregated) in the flow log processing interval between "FlowIntervalStartTime_t" and "FlowIntervalEndTime_t".
FlowStatus string Status of flow which can be allowed or denied.
FlowType string Category of the flows(allowed values are IntraVNet, InterVNet, S2S, P2S, AzurePublic, ExternalPublic, MaliciousFlow, Unknown Private, Unknown) based on IP addresses involved in flow.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
IsFlowCapturedAtUdrHop bool True if flow gets captured at a UDR hop.
L4Protocol string Transport Protocol,T = TCP, U = UDP.
L7Protocol string Application Layer protocol name.
MacAddress string MAC address of the network interface at which the flow was captured.
NsgList string Network Security Group(NSG) associated with the flow. This is a placeholder for NSG flow logging.
NsgRule string NSG rule that allowed or denied this flow. This is a placeholder for NSG flow logging.
NsgRuleType string The type of Network Security Group(NSG) rule used by the flow. This is a placeholder for NSG flow logging.
PacketsDestToSrc long Represents packets sent from the destination to the source of the flow.
PacketsSrcToDest long Represents packets sent from the source to the destination of the flow.
PrivateEndpointResourceId string Resource ID of the private endpoint resource.
PrivateLinkResourceId string Resource ID of the private link service.
PrivateLinkResourceName string Resource name of the private link service.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
SrcApplicationGateway string Application gateway associated with the source IP in the flow.
SrcExpressRouteCircuit string Express route circuit associated with the source IP in the flow.
SrcIp string Source IP address.
SrcLoadBalancer string Load balancer associated with the source IP in the flow.
SrcLocalNetworkGateway string Local network gateway associated with the source IP in the flow.
SrcNic string NIC associated with the source IP in the flow.
SrcPort int Source port.
SrcPublicIps string Source public IP addresses flow information.
SrcRegion string Azure region of virtual network/ network interface/ virtual machine to which the source IP in the flow belongs to.
SrcSubnet string Subnet associated with the source IP in the flow.
SrcSubscription string Subscription of the Azure virtual network/ network interface/ virtual machine to which the source IP in the flow belongs to.
SrcVm string Virtual machine associated with the source IP in the flow.
Status string Status of the ingestion. Possible values can be Completed, Partial or Failed.
SubType string Subtype of the ingestion. Values can be Flowlog and StatusMessage.
TargetResourceId string Target Resource Id for the resource where flow logging has been enabled.
TargetResourceType string Target Resource Type where flow logging is enabled. It can be virtual network(VNET)/subnet(SUBNET)/network interface(NIC).
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The time when the data gets ingested into the log analytics workspace.
TimeProcessed datetime Time(in UTC) at which the traffic analytics processed the raw flow logs from the storage account.
Type string The name of the table