NSG → VNF
Microsoft used to support NSG.
Since 2025 they asked all of the integrations to start ingesting Azure VNF (Azure Virtual Network Flow Logs) instead.
Hunters only supports the FlowLogEvent data (from the NetworkSecurityGroupFlowEvent category).
The NTAIpDetails, NTANetAnalytics, and NTATopologyDetails logs belong to Traffic Analytics in Azure and aren’t required not supported.
Hunters only processes the raw NSG Flow Logs, which looks like:
{"records":[{"time":"2022-09-14T09:00:52.5625085Z","flowLogVersion":4,"flowLogGUID":"GUID_1","macAddress":"MAC_1","category":"FlowLogFlowEvent","flowLogResourceID":"/SUBSCRIPTIONS/SUB_1/RESOURCEGROUPS/RG_1/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NW_1/FLOWLOGS/FLOWLOG_1","targetResourceID":"/subscriptions/SUB_1/resourceGroups/RG_2/providers/Microsoft.Network/virtualNetworks/VNET_1","operationName":"FlowLogFlowEvent","flowRecords":{"flows":[{"aclID":"ACL_1","flowGroups":[{"rule":"DefaultRule_AllowInternetOutBound","flowTuples":["1663146003599,PRIV_IP_1,EXT_IP_1,23956,443,6,O,B,NX,0,0,0,0","1663146003606,PRIV_IP_1,EXT_IP_1,23956,443,6,O,E,NX,3,767,2,1580","1663146003637,PRIV_IP_1,EXT_IP_2,22730,443,6,O,B,NX,0,0,0,0","1663146003640,PRIV_IP_1,EXT_IP_2,22730,443,6,O,E,NX,3,705,4,4569","1663146004251,PRIV_IP_1,EXT_IP_2,22732,443,6,O,B,NX,0,0,0,0","1663146004251,PRIV_IP_1,EXT_IP_2,22732,443,6,O,E,NX,3,705,4,4569","1663146004622,PRIV_IP_1,EXT_IP_2,22734,443,6,O,B,NX,0,0,0,0","1663146004622,PRIV_IP_1,EXT_IP_2,22734,443,6,O,E,NX,2,134,1,108","1663146017343,PRIV_IP_1,EXT_IP_3,36776,443,6,O,B,NX,0,0,0,0","1663146022793,PRIV_IP_1,EXT_IP_3,36776,443,6,O,E,NX,22,2217,33,32466"]}]} ,{"aclID":"ACL_1","flowGroups":[{"rule":"BlockHighRiskTCPPortsFromInternet","flowTuples":["1663145998065,EXT_IP_4,PRIV_IP_1,55188,22,6,I,D,NX,0,0,0,0","1663146005503,EXT_IP_5,PRIV_IP_1,35276,119,6,I,D,NX,0,0,0,0"]},{"rule":"Internet","flowTuples":["1663145989563,EXT_IP_6,PRIV_IP_1,50557,44357,6,I,D,NX,0,0,0,0","1663145989679,EXT_IP_7,PRIV_IP_1,62797,35945,6,I,D,NX,0,0,0,0","1663145989709,EXT_IP_8,PRIV_IP_1,51961,65515,6,I,D,NX,0,0,0,0","1663145990049,EXT_IP_9,PRIV_IP_1,40497,40129,6,I,D,NX,0,0,0,0","1663145990145,EXT_IP_7,PRIV_IP_1,62797,30472,6,I,D,NX,0,0,0,0","1663145990175,EXT_IP_8,PRIV_IP_1,51961,28184,6,I,D,NX,0,0,0,0","1663146015545,EXT_IP_6,PRIV_IP_1,50557,31244,6,I,D,NX,0,0,0,0"]}]}]}}]}Table name: azure_virtual_network_flow_logs
Azure Virtual Network Flow Logs capture information about network traffic flowing through network security groups in an Azure subscription, including details about allowed and denied connections, traffic volume, and flow patterns.
Send data to Hunters
Hunters supports the ingestion of these logs using Azure Event Hub. Follow the steps below to complete the connection.
Send data to Hunters
Hunters supports the ingestion of these logs using Azure Event Hub. Follow the steps below to complete the connection.
STEP 1: Set up Azure Event Hub
Before setting up the connection on the Hunters platform, you'll need to set up and create an Azure Event Hub.
Follow this guide to complete the set up.
STEP 2: Route logs to the Event Hub
1. In the Azure portal home screen, search for and open Resource Groups.
The Resource Group list opens.
2. Select the relevant resource group.
The Resource Group opens.3. Now, scroll down the side menu to the Monitoring section, and click Diagnostic Settings.
The Diagnostic Settings page opens.
4. Select a resource from the Resource list.
Click Add Diagnostic setting.
5. Under Logs, check the Virtual Network Flow Log checkbox.
6. Under Destination details, check the Stream to an Event Hub option.
7. Fill in the requested details and give the diagnostic setting a name.
8. Click Save.
STEP 3: Set up the connection on Hunters
-
Open the Hunters platform and navigate to Data > Data Sources.
-
Click ADD DATA SOURCES.
-
Locate the Microsoft Azure panel and click Connect.
The Add Data Flows window opens. -
Fill in the required Azure application details, as gathered here under STEP 2.
- Under the Data Types section, activate the data types you want to connect.
-
For each activated data type, fill in the required information, as gathered here:
- Under STEP 1 - Subscription ID
- Under STEP 3 - Resource group name and Event Hub namespace and
- Under STEP 4 - Event Hub name.
- OPTIONAL: Under the Consumer group field you can specify a specific Azure Event Hub consumer group, or leave this field empty to use the default consumer group.
- Click Test Connection to make sure everything was set up correctly.
- Once the connection is established, click Submit.