---
title: "Azure Virtual Network Flow Logs"
slug: "azure-virtual-network-flow-logs"
updated: 2026-02-19T22:41:04Z
published: 2026-02-19T22:41:04Z
canonical: "docs.hunters.ai/azure-virtual-network-flow-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Virtual Network Flow Logs

> [!NOTE]
> NSG → VNF
> 
> **Microsoft used to support NSG.**
> 
> Since 2025 they asked all of the integrations to start ingesting Azure VNF (Azure Virtual Network Flow Logs) instead.
> 
> 
> 
> **Hunters only supports the FlowLogEvent data** (from the NetworkSecurityGroupFlowEvent category).
> 
> The NTAIpDetails, NTANetAnalytics, and NTATopologyDetails logs belong to Traffic Analytics in Azure and are not supported.
> 
> 
> 
> **Some more important details:**
> 
> 1. The storage account used for flow logs must be in the same region as the target resource.
> 2. VNF/NSG Flow Logs are written to a Storage Account via Network Watcher.
> 
> 
> 
> Hunters only processes the raw VNF Flow Logs, which looks like:

```json
{ "records": [ { "time": "2022-09-14T09:00:52.5625085Z", "flowLogVersion": 4, "flowLogGUID": "GUID_1", "macAddress": "MAC_1", "category": "FlowLogFlowEvent", "flowLogResourceID": "/SUBSCRIPTIONS/SUB_1/RESOURCEGROUPS/RG_1/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NW_1/FLOWLOGS/FLOWLOG_1", "targetResourceID": "/subscriptions/SUB_1/resourceGroups/RG_2/providers/Microsoft.Network/virtualNetworks/VNET_1", "operationName": "FlowLogFlowEvent", "flowRecords": { "flows": [ { "aclID": "ACL_1", "flowGroups": [ { "rule": "DefaultRule_AllowInternetOutBound", "flowTuples": [ "1122334403599,PRIV_IP_1,EXT_IP_1,11223,443,6,O,B,NX,0,0,0,0", "1122334403606,PRIV_IP_1,EXT_IP_1,11223,443,6,O,E,NX,3,767,2,1580", "1122334403637,PRIV_IP_1,EXT_IP_2,11223,443,6,O,B,NX,0,0,0,0", "1122334403640,PRIV_IP_1,EXT_IP_2,11223,443,6,O,E,NX,3,705,4,4569", "1122334404251,PRIV_IP_1,EXT_IP_2,11223,443,6,O,B,NX,0,0,0,0", "1122334404251,PRIV_IP_1,EXT_IP_2,11223,443,6,O,E,NX,3,705,4,4569", "1122334404622,PRIV_IP_1,EXT_IP_2,11223,443,6,O,B,NX,0,0,0,0", "1122334404622,PRIV_IP_1,EXT_IP_2,11223,443,6,O,E,NX,2,134,1,108", "1122334417343,PRIV_IP_1,EXT_IP_3,11223,443,6,O,B,NX,0,0,0,0", "1122334422793,PRIV_IP_1,EXT_IP_3,11223,443,6,O,E,NX,22,2217,33,32466" ] } ] }, { "aclID": "ACL_1", "flowGroups": [ { "rule": "BlockHighRiskTCPPortsFromInternet", "flowTuples": [ "1122334498065,EXT_IP_4,PRIV_IP_1,11223,22,6,I,D,NX,0,0,0,0", "1122334405503,EXT_IP_5,PRIV_IP_1,11223,11,6,I,D,NX,0,0,0,0" ] }, { "rule": "Internet", "flowTuples": [ "1122334489563,EXT_IP_6,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334489679,EXT_IP_7,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334489709,EXT_IP_8,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334490049,EXT_IP_9,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334490145,EXT_IP_7,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334490175,EXT_IP_8,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0", "1122334415545,EXT_IP_6,PRIV_IP_1,11223,44335,6,I,D,NX,0,0,0,0" ] } ] } ] } } ] }
```

**Table name:** `azure_virtual_network_flow_logs`

Azure Virtual Network Flow Logs capture information about network traffic flowing through network security groups in an Azure subscription, including details about allowed and denied connections, traffic volume, and flow patterns.

## **Send data to Hunters**

Hunters supports the ingestion of these logs using Azure Event Hub. Follow the steps below to complete the connection. **Azure Flow Logs** are **managed exclusively** through **Network Watcher** and must be written to a **Storage Account**, with **Log Analytics** optional for **Traffic Analytics** and from there to be read by an **Azure Function (holding a small reading-writing script)** that would be triggered whenever there’s a new blob-json to be read from the **Azure Storage** and written by this function to **Azure event-hub.**

## **Send data to Hunters**

Hunters supports the ingestion of these logs using Azure Event Hub. Follow the steps below to complete the connection.

### STEP 1: Set up Azure Event Hub

Before setting up the connection on the Hunters platform, you'll need to set up and create an Azure Event Hub.

Follow [this guide](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub) to complete the set up.

### **STEP 2: Route logs to the Event Hub**

1. Azure no longer supports the simple “Diagnostic -> Stream to Event Hub” flow for VNet Flow Logs. There is no direct “Stream to Event Hub” option for VNet Flow Logs under Diagnostic Settings anymore. So in order to send logs to Event Hub, we must architect a forwarding mechanism: Write VNet Flow Logs to Azure **Storage** → Then use some forwarder (Event Grid → Event Hub, Logic App, Function App) to relay **Storage blobs into Event Hub.** Traffic Analytics / Log Analytics exports to Event Hub are summaries - If you try to export using Traffic Analytics → Event Hub, you only get the NTANetAnalytics summarized data - not the full raw flow logs.
2. Some links to official Azure guides: 📌 [Flow Logs overview](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview) (how logs are stored) 📌 [How to manage (configure) VNet Flow Logs to Storage](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage) 📌 [Azure tutorial](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-tutorial) (enable / use VNet Flow Logs)
3. Create the Azure Function App (container first) - Create a resource - Function App ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(295).png)

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(296).png)
4. Basics tab

```plaintext
Subscription: your subscription

Resource Group: same or new

Function App name: vnet-flowlogs-to-eventhub

Runtime stack: Python

Region: same as Storage and Event Hub
```

Hosting tab

```plaintext
Operating System: Linux

Plan type: Consumption

Storage account: auto-create or reuse
```

Click **Review + Create → Create**

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(297).png)
5. Add **Event Hub connection** (output target) Azure Portal → Function App → your app → Configuration Add Application Setting

Click + New application setting

```plaintext
Name: EVENT_HUB_CONNECTION

Value: Event Hub connection string

(from Event Hub → Shared access policies → RootManageSharedAccessKey)
```

Click Save
6. Create the Function itself

```plaintext
Azure Portal → Function App → Functions → + Create

Create function

Development environment: Develop in portal

Template: Event Grid trigger

Function name: FlowLogBlobCreated
```

Click Create
7. Connect Function output to Event Hub

```plaintext
Trigger: Event Grid

Outputs: empty
```

Add Output

```plaintext
Binding type: Event Hub

Event Hub name: your Event Hub name

Event Hub connection: EVENT_HUB_CONNECTION

Send batch: Yes
```

Click Save
8. Connect Storage Account → Event Grid → Function

```plaintext
Azure Portal → Storage Account (where flow logs are written)

Click Events → + Event Subscription → Basics

Name: vnet-flowlogs-to-function

Event Schema: Event Grid Schema

Event types: Blob Created
```

**Filters tab**

`Subject begins with: /blobServices/default/containers/insights-logs-flowlogflowevent/ (this prevents other blobs from triggering)`

**Endpoint tab**
  1. Endpoint type: Azure Function
  2. Subscription: your subscription
  3. Resource group: RG of Function
  4. Function App: your app
  5. Function: FlowLogBlobCreated

**Click Confirm selection**

**Create subscription**

```plaintext
Storage Account → Events

Event subscription filter (container path)

Endpoint = Azure Function
```
9. Minimal Function code (reads blob → sends to Event Hub) Azure gives you a stub. Replace it with minimal, raw-forward logic.

Python example:

```python
import json
import logging
import azure.functions as func
import requests

def main(event: func.EventGridEvent, outputEventHub: func.Out[str]):
    data = event.get_json()

    blob_url = data["url"]

    # Read the blob
    response = requests.get(blob_url)
    response.raise_for_status()

    # Send raw JSON to Event Hub
    outputEventHub.set(response.text)
```
  1. Do NOT parse or enrich
  2. Forward raw blob JSON as-is
  3. Hunters expects FlowLogFlowEvent
10. In the Azure portal, search for and open Network Watcher and create a new exporter for the Vflow logs:

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(290).png)
11. Under Logs, click Flow logs. Click + Create or Create flow log. ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(291).png) On the *Basics* tab, select your **Subscription** and **Virtual Network**. Under *Storage account*, select an Azure Storage Account to which flow logs will be written. Click Review + create and then Create:

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(292).png)

Click Create
12. Now we have Azure VNet Flow Logs written to a Storage Account (Network Watcher writes VNet Flow Logs as blobs to our storage). And we also have a small function (python script) that ingest them into Event Hub. Customers must foollow steps 3 to 9 in order to create a forward pipeline from **Storage → Event Hub.** Azure gives you a few realistic, supported patterns. In our practice, this is the cleanest and most common option (recommended by hunters):

Storage Account → Event Grid → Azure Function → Event Hub
13. If you would like to use **Event Grid to** fire an event whenever a new blob is created and **Azure Function** is triggered by Event Grid. To create Event Grid subscription please follow this next [official Azure Event Grid guide](https://learn.microsoft.com/en-us/azure/event-grid/blob-event-quickstart-portal). ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(294).png)
14. Now the last step would be to create an Azure Function → **Azure Event Hubs bindings for Azure Functions**. **Azure Functions supports trigger and output bindings for Event Hubs**. The Function:
  - Reads the blob (Vflow log blob)
  - Sends the raw JSON to **Event Hub**
  - Hunters consumes from Event Hub (as today)
15. Now you have a full pipeline:

```plaintext
Network Watcher
  (creates flow logs)
        ↓
Storage Account
  (stores blobs)
        ↓
Event Grid
  (detects blob creation and triggers the Azure Function to work)
        ↓
Azure Function
  (reads blob and write it as blob json to Event Hub)
        ↓
Event Hub
        ↓
Hunters
```

### STEP 3: Set up the connection on Hunters

          📘 Before you begin

          To complete this process you will need the information gathered when following [this guide](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub).

**To connect logs to Hunters:**

1. Open the Hunters platform and navigate to **Data > Data Sources**.  

![Data sources1](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Data%20sources%281%29.png)
2. Click **ADD DATA SOURCES**.  

![Add data source4](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Add%20data%20source%284%29.png)
3. Locate the **Microsoft Azure** panel and click **Connect**.  

The Add Data Flows window opens.
4. Fill in the required Azure application details, as gathered [here](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub) under **STEP 2**.  

![Connect Azure logs on Hunters](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Connect%20Azure%20logs%20on%20Hunters.jpg)
5. Under the **Data Types** section, activate the data types you want to connect.
6. For each activated data type, fill in the required information, as gathered [here](https://docs.hunters.ai/docs/connect-data-through-azure-event-hub):
  1. Under STEP 1 - **Subscription ID**
  2. Under STEP 3 - **Resource group name** and **Event Hub namespace** and
  3. Under STEP 4 - **Event Hub name**.
7. OPTIONAL: Under the **Consumer group** field you can specify a specific Azure Event Hub consumer group, or leave this field empty to use the default consumer group.
8. Click **Test Connection** to make sure everything was set up correctly.
9. Once the connection is established, click **Submit**.

## **Expected format**

```json
{
    "records": [
        {
            "time": "2022-09-14T09:00:52.5625085Z",
            "flowLogVersion": 4,
            "flowLogGUID": "66aa66aa-bb77-cc88-dd99-00ee00ee00ee",
            "macAddress": "112233445566",
            "category": "FlowLogFlowEvent",
            "flowLogResourceID": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/NETWORKWATCHERRG/PROVIDERS/MICROSOFT.NETWORK/NETWORKWATCHERS/NETWORKWATCHER_EASTUS2EUAP/FLOWLOGS/VNETFLOWLOG",
            "targetResourceID": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet",
            "operationName": "FlowLogFlowEvent",
            "flowRecords": {
                "flows": [
                    {
                        "aclID": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
                        "flowGroups": [
                            {
                                "rule": "DefaultRule_AllowInternetOutBound",
                                "flowTuples": [
                                    "1122334403599,10.10.10.6,20.0.0.6,11223,443,6,O,B,NX,0,0,0,0",
                                    "1122334403606,10.10.10.6,20.0.0.6,11223,443,6,O,E,NX,3,767,2,0",
                                    "1122334403637,10.10.10.6,20.0.0.7,11223,443,6,O,B,NX,0,0,0,0",
                                    "1122334403640,10.10.10.6,20.0.0.7,11223,443,6,O,E,NX,3,705,4,0",
                                    "1122334404251,10.10.10.6,20.0.0.7,11223,443,6,O,B,NX,0,0,0,0",
                                    "1122334404251,10.10.10.6,20.0.0.7,11223,443,6,O,E,NX,3,705,4,0",
                                    "1122334404622,10.10.10.6,20.0.0.7,11223,443,6,O,B,NX,0,0,0,0",
                                    "1122334404622,10.10.10.6,20.0.0.7,11223,443,6,O,E,NX,2,134,1,1",
                                    "1122334417343,10.10.10.6,20.0.0.8,11223,443,6,O,B,NX,0,0,0,0",
                                    "1122334422793,10.10.10.6,20.0.0.8,11223,443,6,O,E,NX,22,2217,33,0"
                                ]
                            }
                        ]
                    },
                    {
                        "aclID": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
                        "flowGroups": [
                            {
                                "rule": "BlockHighRiskTCPPortsFromInternet",
                                "flowTuples": [
                                    "1122334498065,11.22.33.44,10.10.10.6,11223,22,6,I,D,NX,0,0,0,0",
                                    "1122334405503,11.22.33.44,10.10.10.6,11223,11,6,I,D,NX,0,0,0,0"
                                ]
                            },
                            {
                                "rule": "Internet",
                                "flowTuples": [
                                    "1122334489563,2.2.2.20,10.0.0.10,112,447,6,I,D,NX,0,0,0,0",
                                    "1122334489679,3.3.3.30,10.0.0.10,112,447,6,I,D,NX,0,0,0,0",
                                    "1122334489709,3.3.3.30,10.0.0.10,112,447,6,I,D,NX,0,0,0,0",
                                    "1122334490049,8.8.8.80,10.0.0.10,112,11223,6,I,D,NX,0,0,0,0",
                                    "1122334490145,3.3.3.30,10.0.0.10,112,11223,6,I,D,NX,0,0,0,0",
                                    "1122334490175,2.2.2.20,10.0.0.10,112,447,6,I,D,NX,0,0,0,0",
                                    "1122334415545,2.2.2.20,10.0.0.10,112,1122,6,I,D,NX,0,0,0,0"
                                ]
                            }
                        ]
                    }
                ]
            }
        }
    ]

## Newer version of the network flow logs that we started to support since January 2026:
{
  "records": [
    {
      "SubType": "FlowLog",
      "FaSchemaVersion": "3",
      "TimeProcessed": "2026-02-11T17:24:56.7940000Z",
      "FlowIntervalStartTime": "2026-02-11T17:10:00.0000000Z",
      "FlowIntervalEndTime": "2026-02-11T17:20:00.0000000Z",
      "FlowType": "UnknownPrivate",
      "FlowStartTime": "2026-02-11T15:34:23.0910000Z",
      "FlowEndTime": "2026-02-11T17:19:29.0200000Z",
      "SrcIp": "10.0.0.10",
      "DestIp": "10.0.0.20",
      "DestPort": 55,
      "L4Protocol": "UDP",
      "L7Protocol": "domain",
      "IsFlowCapturedAtUdrHop": false,
      "FlowDirection": "Outbound",
      "FlowStatus": "Allowed",
      "MacAddress": "AA-BB-CC-DD-EE-FF",
      "FlowLogResourceId": "11111111-1111-1111-1111-111111111111/networkwatcherrg/rg_net_watch_anon/flowlog_vnet_anon_001",
      "TargetResourceId": "11111111-1111-1111-1111-111111111111/rg_spoke_anon/vnet_anon_001",
      "TargetResourceType": "VirtualNetwork",
      "SrcSubscription": "11111111-1111-1111-1111-111111111111",
      "SrcRegion": "westeurope",
      "SrcNic": "rg_app_anon/nic-vm-anon-1",
      "SrcVm": "rg_app_anon/vm-anon-1",
      "SrcSubnet": "rg_spoke_anon/vnet_anon_001/subnet_anon_001",
      "FlowEncryption": "Unencrypted",
      "AllowedInFlows": 0,
      "DeniedInFlows": 0,
      "AllowedOutFlows": 51,
      "DeniedOutFlows": 0,
      "PacketsDestToSrc": 148,
      "PacketsSrcToDest": 148,
      "BytesDestToSrc": 56492,
      "BytesSrcToDest": 23099,
      "CompletedFlows": 47,
      "AclGroup": "Unspecified",
      "AclRule": "platformrule",
      "TimeGenerated": "2026-02-11T17:24:58.4860143Z",
      "_ItemId": "aaaaaaaa-aaaa-4aaa-aaaa-aaaaaaaaaaa1",
      "TenantId": "22222222-2222-2222-2222-222222222222",
      "_TimeReceived": "2026-02-11T17:24:58.3671042Z",
      "_IsBillable": false,
      "_BilledSize": 836,
      "_Internal_WorkspaceResourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourcegroups/rg_soc_anon/providers/microsoft.operationalinsights/workspaces/workspace-soc-anon",
      "Type": "NTANetAnalytics"
    },
    {
      "SubType": "FlowLog",
      "FaSchemaVersion": "3",
      "TimeProcessed": "2026-02-11T17:24:56.7940000Z",
      "FlowIntervalStartTime": "2026-02-11T17:10:00.0000000Z",
      "FlowIntervalEndTime": "2026-02-11T17:20:00.0000000Z",
      "FlowType": "UnknownPrivate",
      "FlowStartTime": "2026-02-11T17:09:57.0720000Z",
      "FlowEndTime": "2026-02-11T17:14:57.0760000Z",
      "SrcIp": "10.0.0.10",
      "DestIp": "10.0.0.30",
      "DestPort": 3322,
      "L4Protocol": "TCP",
      "L7Protocol": "ms-wbt-server",
      "IsFlowCapturedAtUdrHop": false,
      "FlowDirection": "Outbound",
      "FlowStatus": "Allowed",
      "MacAddress": "AA-BB-CC-DD-EE-FF",
      "FlowLogResourceId": "11111111-1111-1111-1111-111111111111/networkwatcherrg/rg_net_watch_anon/flowlog_vnet_anon_001",
      "TargetResourceId": "11111111-1111-1111-1111-111111111111/rg_spoke_anon/vnet_anon_001",
      "TargetResourceType": "VirtualNetwork",
      "SrcSubscription": "11111111-1111-1111-1111-111111111111",
      "SrcRegion": "westeurope",
      "SrcNic": "rg_app_anon/nic-vm-anon-1",
      "SrcVm": "rg_app_anon/vm-anon-1",
      "SrcSubnet": "rg_spoke_anon/vnet_anon_001/subnet_anon_001",
      "FlowEncryption": "Unencrypted",
      "AllowedInFlows": 0,
      "DeniedInFlows": 0,
      "AllowedOutFlows": 0,
      "DeniedOutFlows": 0,
      "PacketsDestToSrc": 307,
      "PacketsSrcToDest": 307,
      "BytesDestToSrc": 48208,
      "BytesSrcToDest": 18420,
      "CompletedFlows": 0,
      "AclGroup": "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/rg_spoke_anon/providers/microsoft.network/networksecuritygroups/nsg_anon_001",
      "AclRule": "allowallout",
      "TimeGenerated": "2026-02-11T17:24:58.4860143Z",
      "_ItemId": "bbbbbbbb-bbbb-4bbb-bbbb-bbbbbbbbbbb2",
      "TenantId": "22222222-2222-2222-2222-222222222222",
      "_TimeReceived": "2026-02-11T17:24:58.3671042Z",
      "_IsBillable": false,
      "_BilledSize": 1023,
      "_Internal_WorkspaceResourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourcegroups/rg_soc_anon/providers/microsoft.operationalinsights/workspaces/workspace-soc-anon",
      "Type": "NTANetAnalytics"
    }
  ]
}

{
  "records": [
    {
      "SubType": "StatusMessage",
      "FaSchemaVersion": "3",
      "TimeProcessed": "2026-02-11T17:24:58.6570000Z",
      "FlowIntervalStartTime": "2026-02-11T17:10:00.0000000Z",
      "FlowIntervalEndTime": "2026-02-11T17:20:00.0000000Z",
      "Status": "Completed",
      "TimeGenerated": "2026-02-11T17:24:58.9306745Z",
      "_ItemId": "cccccccc-cccc-4ccc-cccc-ccccccccccc3",
      "TenantId": "22222222-2222-2222-2222-222222222222",
      "_TimeReceived": "2026-02-11T17:24:58.8296898Z",
      "_IsBillable": false,
      "_BilledSize": 124,
      "_Internal_WorkspaceResourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourcegroups/rg_soc_anon/providers/microsoft.operationalinsights/workspaces/workspace-soc-anon",
      "Type": "NTANetAnalytics"
    }
  ]
}
```

The official Azure flow logs are written to Azure Storage in JSON format and from there on with Azure Function to Azure Blob-Storage. There is no direct “Stream to Event Hub” option for VNet Flow Logs under Diagnostic Settings anymore.