# Enable Virtual WAN gateway logging before depending on a log-based alert

> Confirm that the gateway produces the records an alert expects to query.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:10+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Confirm that the gateway produces the records an alert expects to query.

## Potentially affected

Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.

## DSE recommendation

DSE recommends making a sample record a prerequisite for alert acceptance.

## Article

## Source facts

Microsoft distinguishes Virtual WAN gateway metrics from gateway logs. Its site-to-site and point-to-site monitoring guidance says logs require a diagnostic setting; metrics do not establish that such logging exists. A diagnostic setting selects the collected information and its destination. Microsoft therefore places diagnostic configuration before creation of a log-based gateway alert. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan).

## Applicability

Review each gateway named by a planned alert, including the actual diagnostic destination and query scope. Keep a visible metric chart separate from evidence that the selected log category is arriving where the alert reads it.

## DSE recommendation

DSE recommends making a sample record a prerequisite for alert acceptance. Document the gateway identity, selected category, destination, query and notification owner together. Agree on a harmless event or observation that will exercise the intended condition. Review destination access and retention with the responsible team before collecting operational data.

## Verification

Inspect the deployed diagnostic setting, then query a recent interval and confirm the expected resource identifier appears. Exercise the approved alert test and trace it through query evaluation to notification delivery. If no record arrives, investigate collection first. Retain separate evidence for data arrival and for the alert action.

## Official references

[Microsoft Learn: Monitor Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan).

## Primary reference

- Name: Monitor Azure Virtual WAN | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-wan/monitor-virtual-wan
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Enable Virtual WAN gateway logging before depending on a log-based alert,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-050-enable-virtual-wan-gateway-logging-before-depending-on-a-log-based-alert/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.