Synqly Adds Microsoft Azure Network Security Integration for Traffic Visibility

We are announcing a new Microsoft Azure network security integration now live within the Synqly ecosystem. Security vendors building on Synqly can connect directly to Microsoft Azure Network Security and give their OEM customers visibility into network traffic across Azure environments, without carrying the engineering cost of building and maintaining that connector on their own. For product and engineering teams that already support customers across more than one cloud, this is one more provider they no longer have to build and maintain in house.

Microsoft Azure is the cloud infrastructure platform operated by Microsoft, and Azure Network Security refers to the traffic monitoring capability built into that platform through Azure Network Watcher and its network security group flow logs. Those flow logs capture traffic allowed and denied by a network security group, giving a security team visibility into what actually crossed a network boundary rather than a partial view assembled after the fact. Organizations running workloads on Azure rely on this data to catch lateral movement between resources, spot early signs of data exfiltration, and flag network paths that were misconfigured during setup or a later change. That network security group level detail is what turns a network security signal into something a detection engine can act on directly, rather than a summary that arrives after the fact. Readers who want more background on the platform itself can visit the Microsoft website.

With the Microsoft Azure network security integration live, OEM customers building their product on Synqly can query traffic events and pull traffic log configurations from a customer’s Azure environment through one consistent API, rather than writing a separate connector for Azure’s particular flow log format. The query traffic events capability returns network activity normalized to the OCSF Network Activity class (class_uid 4001), so a vendor’s existing detection logic can treat Azure traffic data the same way it already treats traffic data from any other provider inside the Synqly ecosystem. That normalization is what makes multi cloud coverage practical. A product team should not need a separate parser and a separate set of edge cases for every cloud a customer happens to run on.

The query traffic log configurations capability lets a product discover which flow log configurations already exist across a customer’s Azure network security groups before it starts pulling data, which shortens onboarding and removes a good deal of the guesswork that usually comes with standing up a new cloud integration. Together, these two capabilities give security products the raw material to build detections for lateral movement, exfiltration, and misconfigured network paths across Azure infrastructure, without asking an engineering team to first reverse engineer how Azure structures its own network logs. Full configuration and setup instructions for this integration live in the Azure Network Security Configuration Guide on the Synqly documentation site at docs.synqly.com/guides/provider-configuration/azure-networksecurity-setup, and we are not restating those use cases beyond what is documented there.

This integration extends Microsoft’s presence inside the Synqly ecosystem rather than introducing Microsoft to it for the first time. Synqly customers already connect to Microsoft across several categories, including email security through Microsoft Defender for Office 365, identity through Microsoft Entra ID, and SIEM through Microsoft Sentinel. This new Microsoft Azure network security integration adds another category to that already broad footprint. We are linking to those pages rather than repeating their use cases here, since each integration is documented in full on its own page.

Full details on the Microsoft Azure network security integration, including supported capabilities and schema mappings, live on the Microsoft Azure Network Security integration partner page. For hands on setup instructions, the Azure Network Security Configuration Guide at docs.synqly.com/guides/provider-configuration/azure-networksecurity-setup walks through provider configuration from start to finish.

This Microsoft Azure network security integration is part of Synqly’s Network Security Unified API, built around a problem most OEM security vendors already know well. Customers rarely run on just one cloud, and building a separate integration for every provider is slow to ship and expensive to keep up to date as each platform changes its logging formats over time. Instead of standing up and maintaining separate connections to Microsoft Azure, AWS, and Google Cloud in-house, product teams can integrate with Synqly once and pick up new providers, including this Microsoft Azure network security integration, as Synqly adds them to the ecosystem. For a product team deciding where to spend limited engineering time, that tends to be the deciding factor: less time spent maintaining cloud-specific plumbing, and more time spent on the detection and response work that actually differentiates a security product in a crowded market.