You have an Azure subscription that contains 10 network security groups (NSGs), 10 virtual machines, and a Log Analytics workspace named Workspace1…

Azure Monitor Network Insights relies on a feature called Traffic Analytics to analyze

network traffic for insights, including identifying suspicious patterns. The fundamental data

source for Traffic Analytics is Network Security Group (NSG) flow logs. These logs record

all IP traffic flowing through an NSG. Therefore, the first and prerequisite step is to enable

and configure NSG flow logs for the relevant NSGs and direct the output to the Log

Analytics workspace where the analysis will occur.

A. Deploy Connection Monitor: Connection Monitor is used for testing connectivity, latency,

and topology between specific endpoints, not for analyzing the content or patterns of all

network traffic flow.

B. Configure data collection endpoints: Data collection endpoints are used to define how

data is ingested into Azure Monitor, often for private link scenarios. The primary data source

(NSG flow logs) must be enabled first.

C. Configure a private link: A private link provides secure, private connectivity to the Log

Analytics workspace. It is a networking security feature, not the mechanism for generating

the traffic data itself.

1. Microsoft Azure Documentation - Traffic analytics: "Traffic analytics is a cloud-based

solution that provides visibility into user and application activity in your cloud networks.

Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to

provide insights into traffic flow in your Azure cloud."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

2. Microsoft Azure Documentation - Azure Monitor Network Insights overview: "Traffic

Analytics is a key component of Network Insights that processes NSG flow logs to provide

insights into traffic flow... To use Traffic Analytics, you need a Network Watcher enabled in

your subscription, and you need to configure NSG flow logs for the NSGs you want to

monitor."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/network-insights-overview

3. Microsoft Azure Documentation - Tutorial: Log network traffic to and from a virtual

machine using the Azure portal: This tutorial outlines the steps, starting with enabling NSG

flow logging. "To enable traffic analytics, you need an existing network security group to log

traffic for, or you can create a new one... You also need an existing Log Analytics

workspace with read and write access."

URL: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-tutorial