AzureNetworkAnalytics_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Custom Log V1 Yes 🔶 — uses type-suffixed column names
Ingestion API Supported ✓ Yes

Contents

Schema (178 columns)

Source: KQL validation test schema

Column Name Type
_ResourceId string
Access_s string
AddressPrefix_s string
AddressPrefixes_s string
AllowedInFlows_d real
AllowedOutFlows_d real
AllowForwardedTraffic_b int
AllowGatewayTransit_b int
AllowVirtualNetworkAccess_b int
AppGatewayType_s string
ApplicationGateway1_s string
ApplicationGateway2_s string
ApplicationGatewayBackendPools_s string
AzureASN_d real
AzureRegion_s string
BackendAddressPool_s string
BackendIPAddress_s string
BackendPort_d real
BackendSubnets_s string
batchSizeInBytes_d real
BGPEnabled_b int
CircuitProvisioningState_s string
CompletedFlows_d real
ComponentType_s string
Computer string
ConnectingVNets_s string
ConnectionName_s string
ConnectionStatus_s string
ConnectionType_s string
Country_s string
DeniedInFlows_d real
DeniedOutFlows_d real
Description_s string
DestinationAddressPrefix_s string
DestinationPortRange_s string
DestIP_s string
DestPort_d real
DestPublicIPs_s string
Direction_s string
DiscoveryRegion_s string
EgressBytesTransferred_d real
EnableIPForwarding_b int
ExpressRouteCircuit1_s string
ExpressRouteCircuit2_s string
ExpressRouteCircuitPeeringType_s string
FASchemaVersion_s string
FloatingIPEnabled_b int
FlowCount_d real
FlowDirection_s string
FlowEndTime_s string
FlowEndTime_t datetime
FlowIntervalEndTime_t datetime
FlowIntervalStartTime_t datetime
FlowLogStorageAccount_s string
FlowStartTime_s string
FlowStartTime_t datetime
FlowStatus_s string
FlowType_s string
FrontendIPAddress_s string
FrontendIPs_s string
FrontendPort_d real
FrontendSubnet_s string
FrontendSubnets_s string
GatewayConnectionType_s string
GatewaySubnet_s string
GatewayType_s string
InboundBytes_d real
InboundPackets_d real
IngressBytesTransferred_d real
IPAddress string
IsFlowCapturedAtUDRHop_b int
IsFlowEnabled_b int
IsVirtualAppliance_b int
L4Protocol_s string
L7Protocol_s string
LoadBalancer1_s string
LoadBalancer2_s string
LoadBalancerBackendPools_s string
LoadBalancerType_s string
LocalNetworkGateway1_s string
LocalNetworkGateway2_s string
LocalNetworkGateway_s string
MACAddress_s string
ManagementGroupName string
MG string
Name_s string
Network_s string
NetworkFlowType_s string
NextHopIP_s string
NextHopType_s string
NIC1_s string
NIC2_s string
NIC_s string
NSG_s string
NSGList_s string
NSGRule_s string
NSGRules_s string
NSGRuleType_s string
OutboundBytes_d real
OutboundPackets_d real
Peer_s string
PeerASN_d real
PeeringType_s string
PrimaryAzurePort_s string
PrimarybytesIn_d real
PrimarybytesOut_d real
PrimaryNextHop_s string
PrimaryPeerAddressPrefix_s string
Priority_d real
PrivateFrontendIPs_s string
PrivateIPAddresses_s string
Protocol_s string
PublicFrontendIPs_s string
PublicIPAddresses_s string
PublicIPs_s string
RawData string
Region1_s string
Region2_s string
Region_s string
ResourceType string
Routes_s string
RouteTable_s string
RoutingWeight_d real
RuleType_s string
SchemaVersion_s string
SecondaryAzurePort_s string
SecondarybytesIn_d real
SecondarybytesOut_d real
SecondaryNextHop_s string
SecondaryPeerAddressPrefix_s string
ServiceProviderProperties_s string
ServiceProviderProvisioningState_s string
SKU_s string
SkuDetail_s string
SourceAddressPrefix_s string
SourcePortRange_s string
SourceSystem string
SrcIP_s string
SrcPublicIPs_s string
State_s string
Status_s string
Subnet1_s string
Subnet2_s string
Subnet_s string
SubnetPrefixes_s string
SubnetRegion1_s string
SubnetRegion2_s string
Subnetwork_s string
Subscription1_g string
Subscription1_s string
Subscription2_g string
Subscription2_s string
Subscription_g string
SubscriptionName_s string
SubType_s string
Tags_s string
TenantId string
TimeGenerated datetime
TimeProcessed_t datetime
TopologyVersion_s string
Type string
UseRemoteGateways_b int
VIPAddress_s string
VirtualAppliances_s string
VirtualMachine_s string
VirtualNetwork1_s string
VirtualNetwork2_s string
VirtualNetworkGateway1_s string
VirtualNetworkGateway2_s string
VirtualSubnetwork_s string
VlanId_d real
VM1_s string
VM2_s string
VM_s string
VMIP_s string
VmssName_s string
VpnClientAddressPrefixes_s string
Weight_d real

Additional Information

📖 Related Documentation: Traffic Analytics schema - NSG flow log schema and data aggregation

Solutions (4)

This table is used by the following solutions:

Content Items Using This Table (4)

Analytic Rules (2)

In solution Threat Intelligence:

Analytic Rule Selection Criteria
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)

In solution Threat Intelligence (NEW):

Analytic Rule Selection Criteria
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)

Hunting Queries (2)

In solution Cloud Service Threat Protection Essentials:

Hunting Query Selection Criteria
Azure Resources Assigned Public IP Addresses

In solution Legacy IOC based Threat Protection:

Hunting Query Selection Criteria
Connection from external IP to OMI related Ports

Parsers Using This Table (1)

ASIM Parsers (1)

Parser Schema Product Selection Criteria
ASimNetworkSessionAzureNSG NetworkSession Azure NSG flows

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index