{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "slug": "dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture", "url": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/" }, "title": "Verify every handoff in an alert-triggered Network Watcher capture", "summary": "An alert notification alone does not demonstrate that diagnostic packets were collected.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:29+00:00", "modified_at": "2026-09-17T16:46:28+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 214, "potentially_affected": "Use this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source's credential example is one implementation, not a blanket recommendation for a production identity design.", "dse_recommendation": "DSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output.", "primary_source": { "name": "Use Packet Capture to Proactively Monitor Your Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. Microsoft Learn.

\n

Applicability

\n

Use this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.

\n

DSE recommendation

\n

DSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.

\n

Verification

\n

Trigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.

\n

Official references

\n

Microsoft Learn: Use Packet Capture to Proactively Monitor Your Network.

", "content_text": "Source facts\nMicrosoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. Microsoft Learn.\nApplicability\nUse this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.\nDSE recommendation\nDSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.\nVerification\nTrigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.\nOfficial references\nMicrosoft Learn: Use Packet Capture to Proactively Monitor Your Network.", "content_markdown": "## Source facts\n\nMicrosoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered).\n\n## Applicability\n\nUse this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.\n\n## DSE recommendation\n\nDSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.\n\n## Verification\n\nTrigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.\n\n## Official references\n\n[Microsoft Learn: Use Packet Capture to Proactively Monitor Your Network](https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "url": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify every handoff in an alert-triggered Network Watcher capture", "item": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "url": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/", "headline": "Verify every handoff in an alert-triggered Network Watcher capture", "description": "An alert notification alone does not demonstrate that diagnostic packets were collected.", "abstract": "An alert notification alone does not demonstrate that diagnostic packets were collected.", "articleBody": "Source facts\nMicrosoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. Microsoft Learn.\nApplicability\nUse this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.\nDSE recommendation\nDSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.\nVerification\nTrigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.\nOfficial references\nMicrosoft Learn: Use Packet Capture to Proactively Monitor Your Network.", "datePublished": "2026-09-17T16:32:29+00:00", "dateModified": "2026-09-17T16:46:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify every handoff in an alert-triggered Network Watcher capture" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 214, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Packet Capture to Proactively Monitor Your Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered" } } ] } }