topic Re: Can we Ingest Flow logs from VNet in Azure? in Cortex Cloud Discussions

Can we Ingest Flow logs from VNet in Azure?

asharma160 — Fri, 13 Dec 2024 12:07:36 GMT

I got a use case were user has enabled flow logs in Azure on Vnet level but Prisma Cloud ingest data from network watcher from NSG flow log right? can we have any way or method in Prisma Cloud to ingest data from VNet directly?

Re: Can we Ingest Flow logs from VNet in Azure?

LMegrelis — Fri, 13 Dec 2024 15:21:25 GMT

Prisma Cloud ingests network traffic data from Azure through Network Security Group (NSG) flow logs, a feature of Azure Network Watcher. It does not directly ingest Azure VNet flow logs. To enable this, you must configure NSG flow logs to send data to a storage account, and then ensure Prisma Cloud has the necessary permissions to access that storage account.

Here is a checklist on what to verify when configuring network flow logs:

https://docs.prismacloud.io/en/enterprise-edition/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/troubleshoot-azure-account-onboarding#:~:text=Azure%20Flow%20Logs%20configuration%20related%20issues

Here is a list of our supported resources for flow logs:

https://docs.prismacloud.io/en/enterprise-edition/content-collections/search-and-investigate/network-queries/network-flow-queries

Re: Can we Ingest Flow logs from VNet in Azure?

asharma160 — Fri, 13 Dec 2024 16:19:02 GMT

Thanks for reply. That means there is no way to do something in Prisma cloud to ingest flow logs from VNet instead of NSG right?

Re: Can we Ingest Flow logs from VNet in Azure?

LMegrelis — Mon, 16 Dec 2024 18:10:23 GMT

That is correct, as of currently we do not support VNet flow logs ingestion but it is in the pipeline for future enhancements.

Please monitor our new releases notes.

https://docs.prismacloud.io/en/enterprise-edition/rn/look-ahead-planned-updates-prisma-cloud/look-ahead-secure-the-infrastructure

Especially given the announcement from Microsoft "Network security group flow logs in Azure Network Watcher will be retired on 30 September 2027.As part of this retirement, you'll no longer be able to create new NSG flow logs starting 30 June 2025."

source: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview

Re: Can we Ingest Flow logs from VNet in Azure?

MDalbes — Wed, 20 Aug 2025 08:23:36 GMT

Hello, Vnet flowlogs are now supported please follow Step 6 from this documentation