# Verify every handoff in an alert-triggered Network Watcher capture

> An alert notification alone does not demonstrate that diagnostic packets were collected.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:29+00:00
- Modified: 2026-09-17T16:46:28+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

An alert notification alone does not demonstrate that diagnostic packets were collected.

## Potentially affected

Use this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source's credential example is one implementation, not a blanket recommendation for a production identity design.

## DSE recommendation

DSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output.

## Article

## Source facts

Microsoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered).

## Applicability

Use this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.

## DSE recommendation

DSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.

## Verification

Trigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.

## Official references

[Microsoft Learn: Use Packet Capture to Proactively Monitor Your Network](https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered).

## Primary reference

- Name: Use Packet Capture to Proactively Monitor Your Network | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/network-watcher/packet-capture-alert-triggered
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify every handoff in an alert-triggered Network Watcher capture,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-151-verify-every-handoff-in-an-alert-triggered-network-watcher-capture/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.