# Retain relevant NAT Gateway health history with the incident record

> Preserve the resource-health timeline while it remains available in the portal.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-193-retain-relevant-nat-gateway-health-history-with-the-incident-record/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:47+00:00
- Modified: 2026-09-17T16:46:30+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Preserve the resource-health timeline while it remains available in the portal.

## Potentially affected

Use this review when investigating an outbound-connectivity incident involving NAT Gateway. Identify the correct gateway and incident interval. Keep its resource-health observations distinct from application logs, client tests and the state of the remote destination.

## DSE recommendation

DSE recommends attaching the relevant resource-health timeline to the incident record while the documented history is available.

## Article

## Source facts

Microsoft’s NAT Gateway Resource Health guide says the health-history section exposes up to 30 days of events. Resource health is evaluated from the gateway endpoint’s datapath availability. The guidance also describes alerts for changes to Degraded or Unavailable states, giving operators a separate notification path from manually reviewing history. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/nat-gateway/resource-health).

## Applicability

Use this review when investigating an outbound-connectivity incident involving NAT Gateway. Identify the correct gateway and incident interval. Keep its resource-health observations distinct from application logs, client tests and the state of the remote destination.

## DSE recommendation

DSE recommends attaching the relevant resource-health timeline to the incident record while the documented history is available. Record the resource identity and observation time, and compare the events with application symptoms. Review whether a suitable health-state alert and responsible recipient are configured. Choose incident-evidence retention according to the organization’s approved requirements.

## Verification

Reconcile the retained health events with notification timestamps and representative application observations. Confirm the record identifies the gateway and time zone clearly enough for another operator to repeat the comparison. Preserve discrepancies as findings. An Available resource state should not be presented as proof that every application destination or authentication path was working.

## Official references

[Microsoft Learn: Azure NAT Gateway Resource Health](https://learn.microsoft.com/en-us/azure/nat-gateway/resource-health).

## Primary reference

- Name: Azure NAT Gateway Resource Health - Azure NAT Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/nat-gateway/resource-health
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Retain relevant NAT Gateway health history with the incident record,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-193-retain-relevant-nat-gateway-health-history-with-the-incident-record/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.