Skip to content

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

articles/network-watcher/traffic-analytics-faq.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,11 @@ sections:
130130
answer: |
131131
Traffic analytics creates and manages data collection rule (DCR) and data collection endpoint (DCE) resources in the same resource group as the workspace, prefixed with `NWTA`. If you perform any operation on these resources, traffic analytics might not function as expected. For more information, see [Data aggregation in traffic analytics](./traffic-analytics-schema.md#data-aggregation). For more information, see [Data collection rules in Azure Monitor](/azure/azure-monitor/essentials/data-collection-rule-overview?toc=/azure/network-watcher/toc.json) and [Data collection endpoints in Azure Monitor](/azure/azure-monitor/essentials/data-collection-endpoint-overview?toc=/azure/network-watcher/toc.json).
132132
133+
- question: |
134+
Can I apply locks to the DCE and DCR resources created by traffic analytics?
135+
answer: |
136+
It is not recommended to apply locks to DCR and DCE resources created by traffic analytics as these resources are managed by the service. Notably, locked resources would not be cleaned up upon deletion of the related flow logs. If you perform any operation on these resources, traffic analytics might not function as expected. For more information, see [Data aggregation in traffic analytics](./traffic-analytics-schema.md#data-aggregation).
137+
133138
- question: |
134139
How does traffic analytics decide that an IP is malicious?
135140
answer: |
@@ -217,4 +222,4 @@ sections:
217222
| project SourceIp = tostring(split(SourceIp, "|")[0]), DestIp = tostring(split(DestIp, "|")[0]), NSGList_s, NSGRule_s, DestPort_d, L4Protocol_s, FlowStatus_s
218223
| summarize DestPorts= makeset(DestPort_d) by SourceIp, DestIp, NSGList_s, NSGRule_s, L4Protocol_s, FlowStatus_s
219224
```
220-
225+

0 commit comments

Comments
 (0)