# Reconcile Traffic Analytics table names when moving to VNet flow logs

> Check the source table behind saved queries and alerts.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-109-reconcile-traffic-analytics-table-names-when-moving-to-vnet-flow-logs/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:11+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Check the source table behind saved queries and alerts.

## Potentially affected

Use this review when migrating a monitoring workflow to virtual-network flow logs. Inventory the saved queries, workbooks, alert rules and exports that refer to the older tables. Check the actual destination workspace and schema rather than assuming a familiar dashboard now reads the new records.

## DSE recommendation

DSE recommends maintaining a consumer-by-consumer migration list.

## Article

## Source facts

Microsoft’s Traffic Analytics schema documentation identifies NTANetAnalytics as the virtual-network flow-log replacement for AzureNetworkAnalytics_CL. It likewise identifies NTAIPDetails as the replacement for AzureNetworkAnalyticsIPDetails_CL. Traffic Analytics uses Azure Monitor Logs, where custom queries and alerts can consume its data. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema).

## Applicability

Use this review when migrating a monitoring workflow to virtual-network flow logs. Inventory the saved queries, workbooks, alert rules and exports that refer to the older tables. Check the actual destination workspace and schema rather than assuming a familiar dashboard now reads the new records.

## DSE recommendation

DSE recommends maintaining a consumer-by-consumer migration list. For each query, record its operational purpose, current table and the fields needed in the replacement. Review the current schema before changing names; the table mapping alone should not be treated as proof that every old expression remains appropriate. Assign an owner to validate the interpretation of each result.

## Verification

Run the adapted query against a recent interval with known permitted test traffic. Confirm the expected resource and flow are represented, then exercise any dependent alert or report. Record the table and field mapping with the observed result. Resolve empty output or changed grouping before retiring the older monitoring workflow.

## Official references

[Microsoft Learn: Traffic Analytics Schema and Data Aggregation](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema).

## Primary reference

- Name: Traffic Analytics Schema and Data Aggregation - Azure Network Watcher | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-schema
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Reconcile Traffic Analytics table names when moving to VNet flow logs,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-109-reconcile-traffic-analytics-table-names-when-moving-to-vnet-flow-logs/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.