Forum Discussion

Matty1231's avatar
Matty1231
Copper Contributor
Dec 06, 2023

KQL Query for finding out resource's egress going through a specific Virtual Network Gateway

Is there a way to find out individual resources egress that are going through a Virtual Network Gateway VPN.   Pretty much I have an issue where its been noticed that there's high egress going thro...
Kidd_Ip's avatar
Kidd_Ip
MVP
Sep 30, 2025

You may require:

 

  • NSG Flow Logs enabled on subnets or NICs
  • Traffic Analytics turned on in your Log Analytics workspace
  • Your VPN Gateway must be in a subnet with NSG attached

 

Sample on KQL Query:

NTANetAnalytics
| where Direction == "Outbound"
| where RemoteIP !startswith "10."  // Adjust to match your on-prem IP range
| where RemoteIP in ("your_onprem_ip_range")  // Optional: filter to VPN target range
| summarize TotalBytes = sum(TotalBytes) by ResourceId, Subnet, VMName, RemoteIP
| top 10 by TotalBytes desc

 

Resources