Log baseline v0.5.1
GitHub
All tables
Network / Network flow

AzureNetworkAnalytics_CL

Traffic Analytics processed NSG flow log data with aggregated flow records, allow/deny status, and threat intelligence enrichment

Recommendation

AnalyticsData lakePrimarySecondaryPrimary ยท Data lake180 days retention

High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.

How the matrix works

C5 Network activity

Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services

ACSC

  • 2. Network device logs
  • 8. Cloud platform logging
  • 12. Windows DNS server analytic event logs

CISA

  • 3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs

MITRE data sources

  • Network Traffic: Network Traffic Flow

T3 High-volume aggregation

Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

TimeGeneratedAzureNetworkAnalytics_CL_TimeGeneratedPIPsHostNameIndicatorIdPIPFlowStatus_sNetworkSourceIPEmailSourceIpAddressDescriptionExpirationDateTimeIdCallerSlopePublicIPAddresses_sPublicIPsNSG_NameDestPublicIPs_sIndicatorTypeTrafficLightProtocolLevelNSGList_sActivitySubstatusValue

Most used in public rules

  1. DestPublicIPs_s3
  2. FlowDirection_s3
  3. TimeGenerated3
  4. ActivityGroupNames2
  5. AzureNetworkAnalytics_CL_TimeGenerated2
  6. Computer2
  7. Description2
  8. DestPort_d2
  9. EmailSourceIpAddress2
  10. FlowStatus_s2
  11. FlowType_s2
  12. IndicatorId2

Sources for this recommendation

  • Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
  • ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
  • CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.