services / Azure / Network Watcher Lens

A Network Watcher Lens is a network traffic monitoring/capture resource that observes and records traffic flowing through a specified endpoint, part of Azure's network diagnostics tooling.

Monitoring/diagnostic resource; captured traffic can contain sensitive in-transit data, but the asset is a supporting observability component rather than a primary production data store.

Microsoft.​Network/​networkWatchers/​lenses/​Query/​action

Querying a Lens returns captured network traffic contents, which can include sensitive in-transit payloads and metadata, enabling exfiltration of the monitored data.

Risks

1. Data exfiltration (CRITICAL)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links