{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "slug": "dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions", "url": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/" }, "title": "Read Virtual Network flow counters as interval contributions", "summary": "Preserve flow state and direction when calculating traffic totals from continuation and end records.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:59+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 220, "potentially_affected": "Parsers and reports consuming Azure Virtual Network flow logs.", "dse_recommendation": "Test aggregation against a known flow sequence, retaining state and direction instead of treating the last record as a lifetime total.", "primary_source": { "name": "Virtual Network Flow Logs - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.

\n

A Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. Microsoft Learn.

\n

Applicability

\n

Review the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.

\n

DSE recommendation

\n

DSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.

\n

Verification

\n

Run the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.

\n

Official references

\n

Microsoft Learn: Virtual Network Flow Logs. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.\nA Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. Microsoft Learn.\nApplicability\nReview the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.\nDSE recommendation\nDSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.\nVerification\nRun the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.\nOfficial references\nMicrosoft Learn: Virtual Network Flow Logs. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.\n\nA Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview).\n\n## Applicability\n\nReview the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.\n\n## DSE recommendation\n\nDSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.\n\n## Verification\n\nRun the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.\n\n## Official references\n\n[Microsoft Learn: Virtual Network Flow Logs](https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Read Virtual Network flow counters as interval contributions", "item": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/", "headline": "Read Virtual Network flow counters as interval contributions", "description": "Preserve flow state and direction when calculating traffic totals from continuation and end records.", "abstract": "Preserve flow state and direction when calculating traffic totals from continuation and end records.", "articleBody": "Source facts\nFor Continuing and End flow states, Virtual Network flow-log byte and packet values cover the interval since the previous tuple record. Microsoft calculates a conversation total by adding those contributions, rather than treating the final record as the entire conversation.\nA Begin record has no statistics. Sent and received counters are separate, and byte counts include packet headers as well as payload. These distinctions matter when defining the report’s total. Microsoft Learn.\nApplicability\nReview the parser’s flow identity, ordering, state handling, and direction labels. State whether the intended metric is one-way traffic, both directions, or application payload; do not silently treat those measurements as interchangeable.\nDSE recommendation\nDSE recommends a small documented fixture containing Begin, Continuing, and End records. Specify the expected contribution from each record and how duplicate or missing input is handled. Keep incomplete sequences visible in the report rather than inventing counters for absent intervals. Preserve the raw record reference for each aggregate.\nVerification\nRun the fixture through the actual ingestion and reporting path. Compare directional sums with the expected values, then repeat with a duplicated record, a missing continuation, and an empty Begin record. Confirm that the report distinguishes known totals from incomplete observations and does not equate wire bytes with payload size.\nOfficial references\nMicrosoft Learn: Virtual Network Flow Logs. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:59+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-177-read-virtual-network-flow-counters-as-interval-contributions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Read Virtual Network flow counters as interval contributions" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 220, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Virtual Network Flow Logs - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview" } } ] } }