Linux virtual machines should have the network traffic data collection agent installed
Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines. This enables traffic visualization on the network map, network hardening recommendations and specific network threats.
Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.
What this control checks
Linux VMs must have the network traffic data collection (Microsoft Dependency) agent installed
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.compute_vm_network_traffic_data_collection_linux_agent_installed.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6 (Audit Record Review, Analysis, and Reporting) and 3 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to DE.CM-03 (Personnel activity and technology usage are monitored to find potentially adverse events.).
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
1 more clause
- SI-4: System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.g Trails
- 4.2 IT Operations
- 4.4.b IT Operations
- AU-6 Audit Record Review, Analysis And Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
1 more clause
- SI-4 Information System Monitoring
- 0836.09.n2Organizational.1-09.n 09.06 Network Security Management
- 0885.09n2Organizational.3-09.n 09.06 Network Security Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_network_traffic_data_collection_linux_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_network_traffic_data_collection_linux_agent_installed
Last reviewed: 2026-10-11