Can we Ingest Flow logs from VNet in Azure?

[asharma160]

I got a use case were user has enabled flow logs in Azure on Vnet level but Prisma Cloud ingest data from network watcher from NSG flow log right? can we have any way or method in Prisma Cloud to ingest data from VNet directly? 

Prisma Cloud 

[LMegrelis · Accepted solution]

Prisma Cloud ingests network traffic data from Azure through Network Security Group (NSG) flow logs, a feature of Azure Network Watcher. It does not directly ingest Azure VNet flow logs. To enable this, you must configure NSG flow logs to send data to a storage account, and then ensure Prisma Cloud has the necessary permissions to access that storage account.

Here is a checklist on what to verify when configuring network flow logs:

https://docs.prismacloud.io/en/enterprise-edition/content-collections/connect/connect-cloud-accounts...

Here is a list of our supported resources for flow logs:

https://docs.prismacloud.io/en/enterprise-edition/content-collections/search-and-investigate/network...

[asharma160 · Accepted solution]

Thanks for reply. That means there is no way to do something in Prisma cloud to ingest flow logs from VNet instead of NSG right?

[LMegrelis · Accepted solution]

That is correct, as of currently we do not support VNet flow logs ingestion but it is in the pipeline for future enhancements. 

Please monitor our new releases notes. 

https://docs.prismacloud.io/en/enterprise-edition/rn/look-ahead-planned-updates-prisma-cloud/look-ah...

Especially given the announcement from Microsoft "Network security group flow logs in Azure Network Watcher will be retired on 30 September 2027.As part of this retirement, you'll no longer be able to create new NSG flow logs starting 30 June 2025."

source: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview