{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "slug": "dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert", "url": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/" }, "title": "Enable Virtual WAN gateway logging before depending on a log-based alert", "summary": "Confirm that the gateway produces the records an alert expects to query.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:10+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 201, "potentially_affected": "Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.", "dse_recommendation": "DSE recommends making a sample record a prerequisite for alert acceptance.", "primary_source": { "name": "Monitor Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. Microsoft Learn.

\n

Applicability

\n

Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.

\n

DSE recommendation

\n

DSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.

\n

Verification

\n

Inspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.

\n

Official references

\n

Microsoft Learn: Monitor Azure Virtual WAN.

", "content_text": "Source facts\nMicrosoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. Microsoft Learn.\nApplicability\nReview each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.\nDSE recommendation\nDSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.\nVerification\nInspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.\nOfficial references\nMicrosoft Learn: Monitor Azure Virtual WAN.", "content_markdown": "## Source facts\n\nMicrosoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan).\n\n## Applicability\n\nReview each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.\n\n## DSE recommendation\n\nDSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.\n\n## Verification\n\nInspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.\n\n## Official references\n\n[Microsoft Learn: Monitor Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "url": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Enable Virtual WAN gateway logging before depending on a log-based alert", "item": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "url": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/", "headline": "Enable Virtual WAN gateway logging before depending on a log-based alert", "description": "Confirm that the gateway produces the records an alert expects to query.", "abstract": "Confirm that the gateway produces the records an alert expects to query.", "articleBody": "Source facts\nMicrosoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. Microsoft Learn.\nApplicability\nReview each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.\nDSE recommendation\nDSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.\nVerification\nInspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.\nOfficial references\nMicrosoft Learn: Monitor Azure Virtual WAN.", "datePublished": "2026-09-17T16:34:10+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Enable Virtual WAN gateway logging before depending on a log-based alert" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 201, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Monitor Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan" } } ] } }