Reconcile Traffic Analytics table names when moving to VNet flow logs

Source facts

Microsoft’s Traffic Analytics schema documentation identifies NTANetAnalytics as the virtual-network flow-log replacement for AzureNetworkAnalytics_CL. It likewise identifies NTAIPDetails as the replacement for AzureNetworkAnalyticsIPDetails_CL. Traffic Analytics uses Azure Monitor Logs, where custom queries and alerts can consume its data. Microsoft Learn.

Applicability

Use this review when migrating a monitoring workflow to virtual-network flow logs. Inventory the saved queries, workbooks, alert rules and exports that refer to the older tables. Check the actual destination workspace and schema rather than assuming a familiar dashboard now reads the new records.

DSE recommendation

DSE recommends maintaining a consumer-by-consumer migration list. For each query, record its operational purpose, current table and the fields needed in the replacement. Review the current schema before changing names; the table mapping alone should not be treated as proof that every old expression remains appropriate. Assign an owner to validate the interpretation of each result.

Verification

Run the adapted query against a recent interval with known permitted test traffic. Confirm the expected resource and flow are represented, then exercise any dependent alert or report. Record the table and field mapping with the observed result. Resolve empty output or changed grouping before retiring the older monitoring workflow.

Official references

Microsoft Learn: Traffic Analytics Schema and Data Aggregation.