Azure Azure Network Watcher: Traffic Analytics Capability Group

This control can identify anomalous traffic related to one of its sub-techniques (TFTP boot).

This control can detect anomalous traffic or attempts related to network security group (NSG) for remote services.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous traffic with respect to remote access protocols and groups.

This control can detect anomalous network traffic associated with abuse of remote cloud services.

This control can detect direct cloud VM connections.

This control can detect anomalous traffic with respect to specific protocols/ports.

This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption).

This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption).

This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption).

This control can identify anomalous traffic with respect to NSG and application layer protocols.

This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful).

This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful).

This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful).

This control can detect anomalous application protocol traffic related to this technique.

This control can detect anomalous traffic with respect to critical systems and software deployment ports.

This control can detect anomalous traffic between systems and external networks.

This control can detect abuse of internal proxies.

This control can detect abuse of external proxies.

This control can detect abuse of multi-hop proxies.

This control can identify anomalous access to external remote services.

This capability can detect suspicious script execution over a network.

This control can detect anomalous traffic to and from externally facing systems with respect to network security group (NSG) policy.

This control can be used to gain insight into normal traffic from trusted third parties which can then be used to detect anomalous traffic that may be indicative of a threat.

This control can detect network traffic associated with this technique.

This control can detect network traffic associated with this technique.

This capability can detect anomalous network traffic indicative of bandwidth hijacking.

This control can identify volumetric and multi-sourced denial-of-service attacks.

This control can detect endpoint denial of service attacks.

This control can detect endpoint denial of service attacks.

This control can detect endpoint denial of service attacks.

This control can be used to identify anomalous TFTP boot traffic.

This control can be used to identify anomalous traffic related to RDP and SSH sessions or blocked attempts to access these management ports.

This control can detect SSH hijacking.

This control can detect RDP hijacking.

This control can identify anomalous traffic with respect to configuration repositories or identified configuration management ports.

This control can detect collection from configuration repositories.

This control can detect collection from configuration repositories.

This control can detect network service scanning/discovery activity.

This control can identify anomalous traffic that utilizes non-standard application ports.