Azure: Enable NSG Flow Logs

In the Security Cloud Control platform menu, choose Products > Multicloud Defense .

Go to the Resource Groups section in Azure portal.

Click the Create button.

Choose the subscription and provide a name for this new resource group.

Select a Region. (example: (US) East US).

Click the Review + create button.

Go to the storage accounts section and click the Create button.

Select the Subscription and Resource group that was just created.

Select the same region as the resource group.

Provide a name for the storage account.

Click the Review + create button. This creates a storage account where NSG flow logs are stored.

Go to the Subscription section and find the subscription that was recently created.

Navigate to Resource Providers.

Ensure that the microsoft.insights and Microsoft.EventGrid providers are registered. If they are not registered, click the Register button.

Go to the Network Watcher section.

Click Add and add the regions that you want NSG flow logs to be enabled for.

Go to Network Watcher > NSG flow logs.

Create flow logs for the NSG where you want to enable NSG flow log. Provide the storage account created above. Set the Retention days as 30.

Navigate to the storage account created and click on Events.

Click Event Subscription.

Provide a name for this event subscription.

Select the resource group that was created above.

Provide a System Topic Name.

For Filter to Event Types, the default value is Blob Created and Blob Deleted.

For Endpoint Type, select Web Hook.

Click the Select an endpoint link.