Network Watcher flow logs should have traffic analytics enabled
Traffic analytics analyzes flow logs to provide insights into traffic flow in your Azure cloud. It can be used to visualize network activity across your Azure subscriptions and identify hot spots, identify security threats, and more.
Traffic analytics analyzes flow logs to provide insights into traffic flow in your Azure cloud. It can be used to visualize network activity across your Azure subscriptions and identify hot spots, identify security threats, understand traffic flow patterns, pinpoint network misconfigurations and more.
What this control checks
Network Watcher flow logs must have traffic analytics turned on; logs without it fail
Common pitfalls
Interval must be 10 or 60
The policy flags a flow log when trafficAnalyticsInterval is not in "10", "60".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Network Watcher flow logs should have traffic analytics enabled" (2f080164-9f4d-497e-9db6-416dc9f7b48a); PowerPipe control azure_compliance.control.network_watcher_flow_log_traffic_analytics_enabled.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to DE.CM-01 (Networks and network services are monitored to find potentially adverse events.) and ID.AM-03 (Representations of the organization's authorized network communication and internal and external network data flows are...).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- 3.1.g Trails
Related controls
- Application gateways should have Web Application Firewall (WAF) enabled
- Network security groups should limit outbound access from the internet
- IoT hubs should have resource logs enabled
- Stream Analytics jobs should have resource logs enabled
- Network security groups should limit inbound TCP port 53 access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_watcher_flow_log_traffic_analytics_enabled - Powerpipe Control:
azure_compliance.control.network_watcher_flow_log_traffic_analytics_enabled - Azure Policy Definition:
2f080164-9f4d-497e-9db6-416dc9f7b48a
Last reviewed: 2026-10-14