Product

Azure network analysis capabilities

Each capability answers a specific Azure network architecture question from evidence an analysis source provides.

Capability map: what each analysis answers and the evidence it reads.

Architecture Topology

AVAILABLE

See how an Azure network is actually assembled instead of reading resources one at a time.

Answers: What exists, what contains what, and how is it connected?
Evidence: Containment, association, peering, and connectivity relationships.

Topology graph of a hub and a spoke virtual network, their subnets, the peering between them, and the network security groups and route tables attached to each subnet.

Topology graph composition

Architecture Findings

LIMITED

Review deterministic architecture findings with the evidence each one was derived from.

Answers: Which architecture risks were detected, and on what evidence?
Evidence: Findings reported by the analysis source. Not inferred from topology alone.

A findings list where each finding shows its severity, the subnet or resource it was derived from, and the evidence reference behind it.

Severity and evidence mapping

Routing Analysis

LIMITED

Determine how traffic leaves a subnet and which route table governs it.

Answers: Which route table applies to a subnet, and which subnets rely on one?
Evidence: Route table configuration and subnet associations from the graph; the resolved decisions, egress posture, conflicts, and the flattened route table from the Pro evidence.

A subnet with the route table that governs it, the resolved next hop for its routes, and a user-defined route that overrides the default.

Subnet and route-table path model

Security Analysis

LIMITED

Review how networks are separated and what is reachable from the internet.

Answers: What protects each subnet, and what is publicly exposed?
Evidence: Network security group attachment, segmentation relationships, and public IP attachment from the graph; inbound posture, permitted sources, and the rules that apply from the Pro evidence.

Subnets with the network security group attached to each, the inbound rules that apply to them, and the subnets that carry a public IP address.

Exposure and segmentation indicators

Reachability Matrix

LIMITED

Compare every subnet, or every virtual network, against every other in one view.

Answers: Which source-target pairs are allowed, which are blocked, and which the evidence does not decide?
Evidence: Routing decisions and NSG path decisions combined per pair. Cross-network paths are decided by the security overlay, so a single-network analysis reports its pairs as not evaluated rather than guessing.

A subnet-by-subnet reachability matrix whose cells read allowed, blocked, or not evaluated for each source and target pair.

Source-target verdict matrix

Inventory

AVAILABLE

Work through every resource in the environment with its place in the topology.

Answers: What resources exist in scope, and where does each one live?
Evidence: Resource identity, type, resource group, region, parent, and relationship count.

An inventory table of collected resources listing each resource identity, its type, resource group, region, and parent virtual network.

Resource catalog and placement

Deterministic Trace

PRO

Ask whether one endpoint can reach another, and read the ordered path that decides it.

Answers: Can this source reach that destination, and what decides the answer?
Evidence: The paired Pro host evaluates the path from the recorded snapshot; the result carries the ordered hops, the deciding rule, the return-path symmetry, and the confidence. A stored result replays with no host.

A trace result listing the ordered hops between a source and a destination, the rule that decided the path, and whether the return path is symmetric.

Deterministic reasoning steps

Local-first Azure access

AVAILABLE

Analyse Azure architecture without handing Azure credentials to a service.

Answers: Where do Azure credentials live, and where does the data go?
Evidence: Collection runs on the operator workstation; the graph is parsed in the browser.

Two boundaries: the operator workstation holding the Azure identity and the collector, beside the Azure subscription that is read through read-only management access.

Workstation trust boundary

OSS and Pro separation

PRO

Know exactly which capabilities are open source and which require Pro.

Answers: What do I get without a paid edition?
Evidence: The open-source workbench reads a network graph artifact. Pro adds agent collection.

An edition comparison: the open-source capabilities on one side and the Pro capabilities, including connected agent collection, on the other.

Edition and capability mapping

Explore Demo

Open Workbench