{"id":59441,"date":"2026-10-27T12:01:51","date_gmt":"2026-10-27T02:01:51","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/27\/azure-vnet-flow-log-filtering-cuts-costs-without-blind-spots\/"},"modified":"2026-10-27T12:03:20","modified_gmt":"2026-10-27T02:03:20","slug":"azure-vnet-flow-log-filtering-cuts-costs-without-blind-spots","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/27\/azure-vnet-flow-log-filtering-cuts-costs-without-blind-spots\/","title":{"rendered":"Azure VNet Flow Log Filtering Cuts Costs Without Blind Spots"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Azure VNet Flow Log Filtering Cuts Costs Without Blind Spots we will explain how Azure\u2019s newly generally available filtering can reduce network logging costs while preserving the evidence your security team may need.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">Many organisations enable network logging with good intentions, then discover they are storing millions of repetitive records about routine activity. Useful security events become harder to find, storage grows, and more data is sent to analytics platforms that may charge by volume.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Virtual Network flow logs record metadata about connections moving through an Azure VNet, which is your organisation\u2019s private network inside Azure. They show details such as where traffic came from, where it went, which port it used, whether it was allowed or denied, and whether it was encrypted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They do not record the contents of emails, files or application requests. Think of them as a detailed phone bill showing who called whom, when and for how long, rather than a recording of the conversation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why network logging costs quietly grow<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A busy Azure environment creates an enormous amount of routine network activity. Applications check databases, monitoring systems poll servers, backup services transfer data, and security tools repeatedly test whether systems are available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before filtering, VNet flow logging could capture large volumes of this activity even when only a portion was useful for investigations. The data was written to Azure Storage and could then be sent to Traffic Analytics, Microsoft Sentinel or another security information and event management platform, commonly called a SIEM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A SIEM collects security information in one place so suspicious activity can be detected and investigated. Sending it unnecessary data can increase ingestion, retention and operational costs while giving analysts more noise to search through.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is not just a bigger Azure invoice. It can also mean slower investigations and a higher chance that an important connection is overlooked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What VNet flow log filtering changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft made VNet flow log filtering generally available in October 2026. General availability means it is ready for production use with Microsoft\u2019s standard service commitments, rather than being an experimental preview feature.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Filtering lets your team decide which network flows should be recorded. Criteria can include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Source and destination IP addresses<\/strong>, identifying the systems at either end of a connection.<\/li>\n<li><strong>Ports<\/strong>, which usually indicate the type of service being accessed.<\/li>\n<li><strong>Protocols<\/strong>, such as TCP or UDP, which are different methods systems use to communicate.<\/li>\n<li><strong>Traffic direction<\/strong>, allowing inbound and outbound activity to be treated differently.<\/li>\n<li><strong>Encryption state<\/strong>, helping teams focus on traffic that is not properly protected.<\/li>\n<li><strong>Flow state and action<\/strong>, including traffic that was allowed or blocked.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The filtering occurs when the logging configuration decides which flow records to keep. Instead of collecting everything and paying to sort it out later, the aim is to avoid writing low-value records in the first place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Filters can now be managed through the Azure portal as well as PowerShell automation. That makes the capability more accessible while still allowing larger environments to apply consistent settings through scripts and governance processes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The business case is bigger than storage<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Lower data retention costs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Recording fewer flows reduces the amount of data stored. The exact saving depends on traffic patterns, retention periods and where the information is sent, but high-volume environments may have substantial amounts of repetitive activity to remove.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Less downstream processing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If flow data feeds analytics or security platforms, reducing unnecessary records can also reduce downstream processing and ingestion. This should be measured carefully because each service has its own pricing and data-handling model.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Faster security investigations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An analyst investigating an unusual connection should not have to search through millions of routine health checks. A cleaner dataset makes it easier to identify denied connections, unexpected internet access and movement between sensitive systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Clearer cost ownership<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Logging costs often appear as shared infrastructure expenses with no obvious owner. Filtering by network, application or traffic type makes it easier to understand which systems are producing valuable security data and which are generating noise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This complements the cost visibility discussed in our guide to using Azure Monitor advanced metrics to reduce risk and cloud costs. Metrics show where growth is occurring, while flow log filtering helps control one source of that growth.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not filter the evidence you may need<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The danger is treating filtering as a simple cost-cutting exercise. An aggressive rule may lower the bill while removing evidence required to investigate an incident six months later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most organisations should consider retaining visibility into:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Denied inbound connections, particularly from the internet.<\/li>\n<li>Administrative access using services such as remote desktop or secure shell.<\/li>\n<li>Outbound connections from servers that hold sensitive information.<\/li>\n<li>Traffic between production, development and management networks.<\/li>\n<li>Unencrypted connections where encryption is expected.<\/li>\n<li>Access to identity systems, databases, backups and security tools.<\/li>\n<li>Unexpected connections between separate Azure environments.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Flow logs are also useful around Azure Firewall, especially where encrypted SaaS and AI traffic must be inspected without creating bottlenecks. We explore that wider design issue in Azure Firewall Premium performance for secure AI and SaaS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical filtering approach<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Measure before changing anything.<\/strong> Establish current storage volume, analytics ingestion, retention costs and the traffic types creating the most records.<\/li>\n<li><strong>Classify important systems.<\/strong> Identify production applications, identity services, databases, management networks and systems holding personal or commercially sensitive information.<\/li>\n<li><strong>Start with obvious low-value noise.<\/strong> Examples may include approved monitoring checks or repetitive service traffic that is already recorded elsewhere.<\/li>\n<li><strong>Run filters in a controlled scope.<\/strong> Begin with a non-critical VNet or application and compare investigation results before and after filtering.<\/li>\n<li><strong>Review the outcome with security and compliance owners.<\/strong> Cost reduction should not be approved by the cloud team alone.<\/li>\n<li><strong>Document and revisit every filter.<\/strong> Applications, threats and compliance obligations change. A sensible rule today may create a gap next year.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A filter expression can combine criteria using AND and OR logic. For example, the following expressions focus on inbound administrative access and a specific database connection:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Direction=Inbound &amp;amp;&amp;amp; DstPort=22,3389\n\nSrcIP=10.20.0.0\/16 &amp;amp;&amp;amp; DstPort=1433 &amp;amp;&amp;amp; Protocol=TCP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Azure supports equality and inequality checks, IP ranges, port ranges and multiple values. The expressions are case-insensitive, but brackets are not supported, so the order of AND and OR conditions matters. Complex rules should always be tested before production rollout.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the savings could look like<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a representative 200-person organisation running customer applications, test systems, backups and monitoring tools in Azure. Its flow logs produce 1.2 terabytes of records each month, much of it from predictable internal checks and approved service communication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After reviewing the traffic, the organisation retains denied connections, administrative access, sensitive network traffic and unusual outbound activity. It removes selected repetitive records that are already monitored through application and platform logs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If that reduces monthly flow data to 420 gigabytes, the raw logging footprint falls by 65 per cent. The exact financial result will depend on storage, analytics and retention settings, but the organisation also gains a smaller and more useful investigation dataset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is an illustrative scenario, not a guaranteed saving. The correct target is not the smallest possible log volume. It is the lowest volume that still supports security, troubleshooting and compliance requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Australian compliance still requires judgement<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Network flow logs can support the Essential Eight, the Australian government\u2019s cybersecurity framework that many organisations use to reduce common attack risks. They can help with monitoring, investigation and evidence collection, but enabling flow logs does not automatically make an organisation Essential Eight compliant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Businesses must also consider contractual retention requirements, the Australian Privacy Act and any industry-specific obligations. Removing unnecessary data can reduce cost and exposure, but deleting security evidence too early can create a different risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A sound decision should document what is collected, why it is retained, who can access it and how quickly it can be searched during an incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The right outcome is focused visibility<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">VNet flow log filtering gives Azure customers a practical way to control logging volume before it becomes another uncontrolled cloud expense. Used carefully, it can reduce storage and analytics costs while helping security teams focus on activity that deserves attention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The key is to begin with business risk, not a blanket percentage-reduction target. Keep the evidence needed to protect important systems, meet Australian obligations and investigate incidents, then remove noise in measured stages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc combines more than 20 years of enterprise IT experience with hands-on Azure and cybersecurity expertise as a Microsoft Partner and Wiz Security Integrator. If you are unsure whether your Azure logging is costing more than it should or leaving important gaps, we are happy to take a practical look at it with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Azure VNet flow log filtering can reduce storage and analysis costs. Here is how to remove low-value noise without weakening security or compliance visibility.<\/p>\n","protected":false},"author":1,"featured_media":59443,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,19,13,124],"tags":[],"class_list":["post-59441","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-azure","category-azure-security","category-blog","category-cloud-cost-finops"],"jetpack-related-posts":[{"id":56780,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/security-best-practices-for-azure-ai-services\/","url_meta":{"origin":59441,"position":0},"title":"Security Best Practices for Azure AI Services","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Practical, step-by-step guidance to secure Azure AI services end to end\u2014identity, networks, data, prompts, and monitoring\u2014so your teams can innovate confidently without exposing your organisation.","rel":"","context":"In &quot;Azure AI Services&quot;","block_context":{"text":"Azure AI Services","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-ai-services\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1.5x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 2x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 3x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 4x"},"classes":[]},{"id":58065,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-azure-virtual-network-integration-secures-hosted-ai-agents\/","url_meta":{"origin":59441,"position":1},"title":"How Azure Virtual Network Integration Secures Hosted AI Agents","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how Azure Virtual Network integration limits AI agent exposure, controls access to business data, and reduces security and compliance risk.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 1x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 1.5x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 2x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 3x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 4x"},"classes":[]},{"id":56773,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/why-use-an-azure-landing-zone\/","url_meta":{"origin":59441,"position":2},"title":"Why Use an Azure Landing Zone","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn what an Azure Landing Zone is, why it matters, and how to build one that balances speed, security, and cost. Practical steps and examples for technical leaders and engineers.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png 1x, \/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png 1.5x, \/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png 2x, \/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png 3x, \/wp-content\/uploads\/2025\/11\/why-use-an-azure-landing-zone-for-secure-scalable-cloud-growth.png 4x"},"classes":[]},{"id":58696,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/azure-firewall-ipv6-readiness-checklist-for-security-leaders\/","url_meta":{"origin":59441,"position":3},"title":"Azure Firewall IPv6 Readiness Checklist for Security Leaders","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Azure Firewall now supports IPv6 in preview. Use this practical checklist to identify security gaps, control migration risk and prepare your Azure environment for dual-stack networking.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png 1x, \/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png 1.5x, \/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png 2x, \/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png 3x, \/wp-content\/uploads\/2026\/08\/azure-firewall-ipv6-readiness-checklist-for-security-leaders.png 4x"},"classes":[]},{"id":56798,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/block-prompt-attacks-with-azure-ai-services\/","url_meta":{"origin":59441,"position":4},"title":"Block Prompt Attacks with Azure AI Services","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how to block prompt injection and jailbreak attacks using Azure AI, with practical patterns for safe, production-ready AI applications on Microsoft Azure.","rel":"","context":"In &quot;Azure AI Services&quot;","block_context":{"text":"Azure AI Services","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-ai-services\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png 1x, \/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png 1.5x, \/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png 2x, \/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png 3x, \/wp-content\/uploads\/2025\/11\/block-prompt-attacks-with-azure-ai-in-real-world-apps.png 4x"},"classes":[]},{"id":57591,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/designing-secure-ai-agent-infrastructure-on-azure\/","url_meta":{"origin":59441,"position":5},"title":"Designing Secure AI Agent Infrastructure on Azure","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"AI agents are moving from demos into production workflows. They can read documents, call APIs, query databases, create tickets, summarise customer history, and trigger business processes. That power creates a new infrastructure problem for Australian organisations: an AI agent is not just a chatbot. It is an application runtime, an\u2026","rel":"","context":"In &quot;AI Governance &amp; Risk Management&quot;","block_context":{"text":"AI Governance &amp; Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png 1x, \/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png 1.5x, \/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png 2x, \/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png 3x, \/wp-content\/uploads\/2026\/05\/designing-secure-ai-agent-infrastructure-on-azure.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/azure-vnet-flow-log-filtering-cuts-costs-without-blind-spots.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59441"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59441\/revisions"}],"predecessor-version":[{"id":59442,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59441\/revisions\/59442"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59443"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}