Missing or disabled flow logging blinds visibility into network behavior, hindering detection of:

• Lateral movement and internal scanning
• C2 beacons and exfiltration patterns This degrades incident response and correlation, impacting confidentiality and integrity.

Enable and centrally aggregate NSG flow logs to a Log Analytics workspace.

• Enforce least privilege on log data
• Define retention and secure storage
• Use layered monitoring (e.g., Traffic Analytics)
• Ensure coverage across regions/subscriptions and critical NSGs

• https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-tutorial
• https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-4-enable-network-logging-for-security-investigation