Wire Data 2.0 (Preview) solution in Azure Monitor (Retired)

Note

The Wire Data solution has been replaced with VM insights and Service Map solution. Both use the Log Analytics agent and Dependency agent to collect network connection data into Azure Monitor.

Support for Wire Data solution will end on March 31, 2022. Until the retirement date, existing customers using the Wire Data 2.0 (preview) solution may continue to use it.

New and existing customers should install the VM insights or Service Map solution. The Map data set they collect is comparable to the Wire Data 2.0 (preview) data set. VM insights includes the Service Map data set along with additional performance data and features for analysis. Both offerings have connections with Microsoft Sentinel.

Wire data is consolidated network and performance data collected from Windows-connected and Linux-connected computers with the Log Analytics agent, including those monitored by Operations Manager in your environment. Network data is combined with your other log data to help you correlate data.

In addition to the Log Analytics agent, the Wire Data solution uses Microsoft Dependency Agents that you install on computers in your IT infrastructure. Dependency Agents monitor network data sent to and from your computers for network levels 2-3 in the OSI model, including the various protocols and ports used. Data is then sent to Azure Monitor using agents.

Migrate to Azure Monitor VM insights or Service Map

In many cases, we see that customers often have both Wire Data 2.0 (preview) and VM insights or Service Map solution already enabled on the same VMs. This means you have the replacement offering enabled on your VM. You can simply remove the Wire Data 2.0 (preview) solution from your Log Analytics workspace.

If you have VMs that only have Wire Data 2.0 (preview) enabled on them, then you can onboard the VMs to VM insights or Service Map solution and then remove the Wire Data 2.0 (preview) solution from your Log Analytics workspace.

Migrate your queries to the VMConnection table from Azure Monitor VM insights

Agents providing data

Wire Data 2.0 query

WireData
| summarize AggregatedValue = sum(TotalBytes) by Computer
| limit 500000

VM insights and Service Map query

VMConnection
| summarize AggregatedValue = sum(BytesReceived + BytesSent) by Computer
| limit 500000

IP Addresses of the agents providing data

Wire Data 2.0 query

WireData
| summarize AggregatedValue = count() by LocalIP

VM insights and Service Map query

VMComputer
| distinct Computer, tostring(Ipv4Addresses)

All Outbound communications by Remote IP Address

Wire Data 2.0 query

WireData
| where Direction == "Outbound"
| summarize AggregatedValue = count() by RemoteIP

VM insights and Service Map query

VMConnection
| where Direction == "outbound"
| summarize AggregatedValue = count() by RemoteIp

Bytes received by Protocol Name

Wire Data 2.0 query

WireData 
| where Direction == "Inbound"
| summarize AggregatedValue = sum(ReceivedBytes) by ProtocolName

VM insights and Service Map query

VMConnection
| where Direction == "inbound"
| summarize AggregatedValue = sum(BytesReceived) by Protocol

Amount of Network Traffic (in Bytes) by Process

Wire Data 2.0 query

WireData
| summarize AggregatedValue = sum(TotalBytes) by ProcessName

VM insights and Service Map query

VMConnection
| summarize sum(BytesReceived), sum(BytesSent) by ProcessName

More examples queries

Refer to the VM insights log search documentation and the VM insights alert documentation for additional example queries.

Uninstall Wire Data 2.0 Solution

To uninstall Wire Data 2.0 you simply need to remove the Solution from your Log Analytics Workspace(s). This will result in the following:

• The Wire Data Management pack being removed from the VMs that are connected to the Workspace.
• The Wire Data data type no longer appearing in your Workspace

Follow these instructions to remove the Wire Data solution.

Note

If you have either the Service Map or VM insights solution on your workspace then the management pack will not be removed, as these solutions also use this management pack.

Wire Data 2.0 Management packs

When Wire Data is activated in a Log Analytics workspace, a 300-KB management pack is sent to all the Windows servers in that workspace. If you are using System Center Operations Manager agents in a connected management group, the Dependency Monitor management pack is deployed from System Center Operations Manager. If the agents are directly connected, Azure Monitor delivers the management pack.

The management pack is named Microsoft.IntelligencePacks.ApplicationDependencyMonitor. It's written to: %Programfiles%\Microsoft Monitoring Agent\Agent\Health Service State\Management Packs. The data source that the management pack uses is: %Program files%\Microsoft Monitoring Agent\Agent\Health Service State\Resources<AutoGeneratedID>\Microsoft.EnterpriseManagement.Advisor.ApplicationDependencyMonitorDataSource.dll.

Uninstall the Dependency agent

Note

If you plan to replace Wire Data with either Service Map or VM insights, you should not remove the Dependency agent.

Use the following sections to help you remove the Dependency agent.

Uninstall the Dependency agent on Windows

An administrator can uninstall the Dependency agent for Windows through Control Panel.

An administrator can also run %Programfiles%\Microsoft Dependency Agent\Uninstall.exe to uninstall the Dependency agent.

Uninstall the Dependency agent on Linux

To completely uninstall the Dependency agent from Linux, you must remove the agent itself and the connector, which is installed automatically with the agent. You can uninstall both by using the following single command:

rpm -e dependency-agent dependency-agent-connector

Using the Wire Data 2.0 solution

In the Overview page for your Log Analytics workspace in the Azure portal, click the Wire Data 2.0 tile to open the Wire Data dashboard. The dashboard includes the sections in the following table. Each section lists up to 10 items matching that section's criteria for the specified scope and time range. You can run a log search that returns all records by clicking See all at the bottom of the section or by clicking the section header.

Section	Description
Agents capturing network traffic	Shows the number of agents that are capturing network traffic and lists the top 10 computers that are capturing traffic. Click the number to run a log search for WireData | summarize sum(TotalBytes) by Computer | take 500000. Click a computer in the list to run a log search returning the total number of bytes captured.
Local Subnets	Shows the number of local subnets that agents have discovered. Click the number to run a log search for WireData | summarize sum(TotalBytes) by LocalSubnet that lists all subnets with the number of bytes sent over each one. Click a subnet in the list to run a log search returning the total number of bytes sent over the subnet.
Application-level Protocols	Shows the number of application-level protocols in use, as discovered by agents. Click the number to run a log search for WireData | summarize sum(TotalBytes) by ApplicationProtocol. Click a protocol to run a log search returning the total number of bytes sent using the protocol.

You can use the Agents capturing network traffic section to determine how much network bandwidth is being consumed by computers. This section can help you easily find the chattiest computer in your environment. Such computers could be overloaded, acting abnormally, or using more network resources than normal.

Similarly, you can use the Local Subnets section to determine how much network traffic is moving through your subnets. Users often define subnets around critical areas for their applications. This section offers a view into those areas.

The Application-level Protocols section is useful because it's helpful know what protocols are in use. For example, you might expect SSH to not be in use in your network environment. Viewing information available in the section can quickly confirm or disprove your expectation.

It's also useful to know if protocol traffic is increasing or decreasing over time. For example, if the amount of data being transmitted by an application is increasing, that might be something you should be aware of, or that you might find noteworthy.

Input data

Wire data collects metadata about network traffic using the agents that you have enabled. Each agent sends data about every 15 seconds.

Output data

A record with a type of WireData is created for each type of input data. WireData records have properties shown in the following table:

Property	Description
Computer	Computer name where data was collected
TimeGenerated	Time of the record
LocalIP	IP address of the local computer
SessionState	Connected or disconnected
ReceivedBytes	Amount of bytes received
ProtocolName	Name of the network protocol used
IPVersion	IP version
Direction	Inbound or outbound
MaliciousIP	IP address of a known malicious source
Severity	Suspected malware severity
RemoteIPCountry	Country/region of the remote IP address
ManagementGroupName	Name of the Operations Manager management group
SourceSystem	Source where data was collected
SessionStartTime	Start time of session
SessionEndTime	End time of session
LocalSubnet	Subnet where data was collected
LocalPortNumber	Local port number
RemoteIP	Remote IP address used by the remote computer
RemotePortNumber	Port number used by the remote IP address
SessionID	A unique value that identifies communication session between two IP addresses
SentBytes	Number of bytes sent
TotalBytes	Total number of bytes sent during session
ApplicationProtocol	Type of network protocol used
ProcessID	Windows process ID
ProcessName	Path and file name of the process
RemoteIPLongitude	IP longitude value
RemoteIPLatitude	IP latitude value

Next steps

• See Deploy VM insights for requirements and methods that to enable monitoring for your virtual machines.
• Search logs to view detailed wire data search records.