# Check NAT Gateway metric aggregation before interpreting a connection-count chart

> Avoid counting metric samples when the question concerns the values they contain.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-071-check-nat-gateway-metric-aggregation-before-interpreting-a-connection-count-chart/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:49+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Avoid counting metric samples when the question concerns the values they contain.

## Potentially affected

Review saved charts, alert definitions and exported evidence that use NAT Gateway metrics. Identify the exact metric, selected dimensions, aggregation and time interval before comparing totals or interpreting a small amount of unexplained traffic.

## DSE recommendation

DSE recommends including chart configuration alongside any reported measurement.

## Article

## Source facts

Microsoft discourages Count aggregation for NAT Gateway metrics because it counts reported metric values instead of adding their contents. Its guidance uses Sum for connection, byte and packet counts, and Average for datapath availability. The documentation also notes that platform health-check connections can appear in the SNAT connection metric. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-metrics).

## Applicability

Review saved charts, alert definitions and exported evidence that use NAT Gateway metrics. Identify the exact metric, selected dimensions, aggregation and time interval before comparing totals or interpreting a small amount of unexplained traffic.

## DSE recommendation

DSE recommends including chart configuration alongside any reported measurement. Have the monitoring owner check whether the chosen aggregation answers the operational question. Correct misleading saved views and revisit conclusions that depended on them. Keep application-generated test traffic distinct from the background observations rather than labeling every connection as a user transaction.

## Verification

For a fixed observation interval, compare the approved chart with the same metric values using the documented aggregation. Preserve metric name, filters, interval and configuration with the result. Exercise a small authorized traffic test and check that the chart responds as expected. If numbers still disagree, inspect dimension selection before adjusting capacity or security controls.

## Official references

[Microsoft Learn: Metrics and alerts for Azure NAT Gateway](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-metrics).

## Primary reference

- Name: Metrics and alerts for Azure NAT Gateway - Azure NAT Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/nat-gateway/nat-metrics
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check NAT Gateway metric aggregation before interpreting a connection-count chart,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-071-check-nat-gateway-metric-aggregation-before-interpreting-a-connection-count-chart/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.