Applies To: WatchGuard NDR
This feature is only available with a WatchGuard NDR or Total NDR license. For more information, go to About WatchGuard NDR Licenses and About Total NDR Licenses.
WatchGuard NDR enables you to monitor logs from third-party cloud environments, such as Azure flow logs.
Azure Virtual Network (VNet) flow logs provide granular visibility into network activity across computing resources in your Azure environment. WatchGuard NDR uses VNet flow logs for advanced traffic analysis, to detect anomalies, identify potential security threats, and generate alerts.
Only VNet flow logs are supported. Network Security Group (NSG) flow logs will retire on 30 September 2027, and new NSG flow logs cannot be created effective 30 June 2025. For more information, go to Flow logging for network security groups in the Microsoft Azure documentation.
For more information about WatchGuard NDR cloud integration with Azure flow logs, go to these sections:
Licensing
To use Azure flow log integration with WatchGuard NDR, you must purchase and activate a WatchGuard NDR or Total NDR license. WatchGuard NDR and Total NDR are licensed for each user.
For more information about licensing, go to About WatchGuard NDR Licenses and About Total NDR Licenses.
Add a NDR Cloud Integration
To add a cloud integration, you use the NDR Integrations UI in WatchGuard Cloud. To add a NDR cloud integration, select Configure > NDR Integrations > Cloud Integration.
For more information, go to Configure a WatchGuard NDR Cloud Integration — Azure Flow Logs.
NDR UI
To configure and monitor WatchGuard NDR, you use the NDR UI in WatchGuard Cloud. To connect to WatchGuard Cloud, go to cloud.watchguard.com.
Available pages and features vary and depend on your license type. Throughout this documentation, NDR refers generally to all products. If you do not see a page or feature in the NDR UI, it is not supported by your product.
Monitor WatchGuard NDR
To monitor your WatchGuard NDR cloud integration, use these pages:
- Network Summary — Provides an overview of trends in your network and includes links to detailed information about Smart Alerts and policy alerts. For more information, go to About the NDR Network Summary Page.
- Smart Alerts — Shows open Smart Alerts for operators to review and respond to. For more information, go to About Smart Alerts.
- Policy Alerts — Shows alerts for policy violations on your network and includes detailed traffic information about your Azure flow logs. For more information, go to About Policy Alerts.
- NDR Audit Logs — Shows details of configuration activity performed for policies, zones, users, IP addresses, and SaaS collector changes. For more information, go to NDR Audit Logs.
- All IP Addresses — Shows details about internal and external IP addresses. You can use the information on this page to view the internal IP address of your Azure virtual machine. For more information, go to All IP Addresses.
Configure WatchGuard NDR
To configure WatchGuard NDR, select Configure > NDR.
You can use this page to configure alerts for a WatchGuard NDR integration with Azure flow logs:
- Alerts — Configure Azure flow logs heartbeat alerts. For more information, go to Configure WatchGuard NDR and WatchGuard SaaS DR Alerts and Notification Rules for Subscribers.
Configure a WatchGuard NDR Cloud Integration — Azure Flow Logs