Skip to main content
Version: 7.8

Azure VNET Flow Log IEs

NetObserv Flow supports the following AWS VPC Flow Log information elements (IE).

Azure fieldFlow record fieldDescription
N/Aflow.export.typeIndicates that the flow came from an Azure VNet Flow Log. Value is always azure_vnet_flow_log
timeflow.export.timestampTime in UTC when the event was logged.
macAddressflow.out.netif.macMAC address of the network interface where the event was captured.
flowLogGUIDazure.flowlog.resource.guidResource GUID of the FlowLog resource.
flowLogResourceIDazure.flowlog.resource.idResource ID of the FlowLog resource.
targetResourceIDazure.flowlog.target.resource.idResource ID of the target resource that's associated with the FlowLog resource.
flowLogVersionazure.flowlog.version.verVersion of the flow log.
categoryazure.category.nameCategory of the event. The category is always FlowLogFlowEvent.
operationNameazure.operation.nameAlways FlowLogFlowEvent.
flowRecords → flows → aclIDazure.acl.idIdentifier of the resource that's evaluating traffic, either a network security group or Virtual Network Manager. For traffic that's denied because of encryption, this value is unspecified.
flowRecords→ flows → flowGroups → rulesec.rule.nameName of the rule that allowed or denied the traffic. For traffic that's denied because of encryption, this value is unspecified.
flowRecords→ flows → flowGroups → flowTuples → Time stampflow.start.timestampTime stamp of when the flow occurred.
flowRecords→ flows → flowGroups → flowTuples → Time stampflow.collect.timestampTime stamp of when the flow occurred.
flowRecords→ flows → flowGroups → flowTuples → Flow directionflow.direction.nameDirection of the traffic flow. Valid values are Ingress and Egress.
flowRecords→ flows → flowGroups → flowTuples → Source IPflow.src.ip.addrSource IP address.
flowRecords→ flows → flowGroups → flowTuples → Source portflow.src.l4.portSource port.
flowRecords→ flows → flowGroups → flowTuples → Destination IPflow.dst.ip.addrDestination IP address.
flowRecords→ flows → flowGroups → flowTuples → Destination portflow.dst.l4.portDestination port.
flowRecords→ flows → flowGroups → flowTuples → Packets sentflow.out.packetsTotal number of packets sent from the source to the destination since the last update.
flowRecords→ flows → flowGroups → flowTuples → Bytes sentflow.out.bytesTotal number of packet bytes sent from the source to the destination since the last update. Packet bytes include the packet header and payload.
flowRecords→ flows → flowGroups → flowTuples → Packets receivedflow.in.packetsotal number of packets sent from the destination to the source since the last update.
flowRecords→ flows → flowGroups → flowTuples → Bytes receivedflow.in.bytesTotal number of packet bytes sent from the destination to the source since the last update. Packet bytes include the packet header and payload.
flowRecords→ flows → flowGroups → flowTuples → Protocoll4.protoLayer 4 protocol of the flow, expressed in IANA assigned values.
flowRecords→ flows → flowGroups → flowTuples → Flow Stateazure.flow.stateState of the flow. Possible states are begin, continuing, end, and deny.
flowRecords→ flows → flowGroups → flowTuples → Flow Encryptionazure.flow.encryptEncryption state of the flow. Possible states are encrypted, unencrypted, hardware_not_supported, software_not_ready, not_accepted, not_supported, local_dest, and fallback