What the fastest means to see traffic flow logs from the Azure firewall?

Question

I am used to Palo Alto Network firewall where I can just click monitor/traffic and see and sort and filter all the network flows going through the firewall. I keep looking for something even remotely as simple to execute but so far no go. I want to see:

Date/Time, Source IP, Dest IP, Protocol, Port, TCP end state, bytes sent/received

And I want to then filter by time or any of these fields. Is this a standard feature or do I need to write queries and time I want this kind of output?

Answer 1

Hi @Netwiedz

You can visualize network traffic patterns with Azure Network Watcher and open source tools. Network Watcher's packet capture feature allows you to capture the data necessary to perform network forensics and better understand your network traffic. You can use open-source tools such as CapAnalysis to visualize packets captures and perform deep packet inspection.

With CapAnalysis, you can quickly identify trends within your network traffic and see the information you are looking for, such as date/time, source IP, dest IP, protocol, port, TCP end state, bytes sent/received. You can also filter by time or any of these fields.

You can also use Azure Firewall Workbooks to monitor logs and understand more about the resource based on the source IP address. You can get information like virtual machine name and network interface name. It's simple to filter to the resource from the logs.

For details, see

https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-using-open-source-tools

https://learn.microsoft.com/en-us/azure/firewall/firewall-workbook

Please accept as answer and upvote if the above information is helpful for the benefit of the community.