AzureWAF

Details

ID	`AzureWAF`
Provider	Microsoft
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/crypto:1.0.0.8931184`
Supported Modules	Agentix XSIAM

README

The Azure WAF (Web Application Firewall) integration provides centralized protection of your web applications from common exploits and vulnerabilities.
It enables you to control policies that are configured in the Azure Firewall management platform, and allows you to add, delete, or update policies,
and also to get details of a specific policy or a list of policies.

In order to connect to the AzureWAF using either Cortex XSOAR Azure App or the Self-Deployed Azure App, use one of the following methods:

Authorization Code Flow (Recommended).
Device Code Flow.
Azure Managed Identities
Client Credentials Flow.

Self-Deployed Application

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.

Required Permissions

The following API permissions are required in Azure:

API	Permission
Azure Service Management	user_impersonation
Microsoft Graph	offline_access
Microsoft Graph	User.Read

Authentication Using the Authorization Code Flow (recommended)

Follow these steps for a self-deployed configuration:

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article steps 1-8.
choose the Authorization Code option in the Authentication Type parameter.
Enter your Client/Application ID in the Application ID parameter.
Enter your Client Secret in the Client Secret parameter.
Enter your Tenant ID in the Tenant ID parameter.
Enter your Application redirect URI in the Application redirect URI parameter.
Save the instance.
Run the !azure-waf-generate-login-url command in the War Room and follow the instruction.
Run the !azure-waf-auth-test command - a ‘Success’ message should be printed to the War Room.

Authentication Using the Device Code Flow

Use the device code flow
to link Azure SQL Management with Cortex XSOAR.

In order to connect to Azure Web Application Firewall using either the Cortex XSOAR Azure or Self Deployed Azure application:

Fill in the required parameters
choose the Device Code option in the Authentication Type parameter.
Run the !azure-waf-auth-start command.
Follow the instructions that appear.
Run the !azure-waf-auth-complete command.
At end of the process, you will see a message that you logged in successfully.

Cortex XSOAR Azure app

In order to use the Cortex XSOAR Azure application, use the default application ID (cf22fd73-29f1-4245-8e16-533704926d20) and fill in your subscription ID and default resource group name.

You only need to fill in your subscription ID and resource group name. You can find your resource group and
subscription ID in the Azure Portal. For a more detailed explanation, visit this page.

Azure Managed Identities Authentication

Note: This option is relevant only if the integration is running on Azure VM

Follow one of these steps for authentication based on Azure Managed Identities:

To use System Assigned Managed Identity
- In the Authentication Type drop-down list, select Azure Managed Identities and leave the Azure Managed Identities Client ID field empty.
To use User Assigned Managed Identity
1. Go to Azure Portal -> Managed Identities.
2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the Azure Managed Identities client id field in the instance configuration.
3. In the Authentication Type drop-down list, select Azure Managed Identities.

For more information, see Managed identities for Azure resources.

Client Credentials Flow Authentication

Assign Azure roles using the Azure portal Microsoft article
Note: In the Select members section, assign the application you created earlier.
To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:

In the Authentication Type field, select the Client Credentials option.
In the Application ID field, enter your Client/Application ID.
In the Tenant ID field, enter your Tenant ID .
In the Client Secret field, enter your Client Secret.
Click Test to validate the URLs, token, and connection
Save the instance.

Testing authentication and connectivity

If you are using Device Code Flow or Authorization Code Flow, for testing your authentication and connectivity to the AzureWAF service run the !azure-waf-auth-test command.

Configure AzureWAF on Cortex XSOAR/XSIAM

Navigate to one of the following:
- Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances
- Cortex XSOAR 6: Settings > Integrations > Servers & Services.
- Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations
Search for Azure Web Application Firewall.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
App ID		False
Default Subscription ID		True
Default Resource Group Name		True
Authentication Type	Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, or Azure Managed Identities.	True
Tenant ID (for authorization code mode)		False
Client Secret (for authorization code mode)		False
Client Secret (for authorization code mode)		False
Application redirect URI (for authorization code mode)		False
Authorization code	for user-auth mode - received from the authorization step. see Detailed Instructions (?) section	False
Authorization code		False
Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False
Azure AD endpoint	Azure AD endpoint associated with a national cloud.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-waf-policies-get

Retrieves protection policies within a resource group.

Base Command

azure-waf-policies-get

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.	Optional
resource_group_name	Comma-separated value list of the names of the resource groups. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional
verbose	Whether to retrieve full details of the policy. Possible values are: “true” and “false”. Default is “false”.	Optional
limit	Maximum number of policies to fetch. Default is “10”.	Optional

Context Output

Path	Type	Description
AzureWAF.Policy.name	String	Resource name.
AzureWAF.Policy.id	String	Resource ID.
AzureWAF.Policy.type	String	Resource type.
AzureWAF.Policy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.Policy.tags	String	Resource tag.
AzureWAF.Policy.location	String	Resource location.
AzureWAF.Policy.properties.resourceState	String	Resource status of the policy.
AzureWAF.Policy.properties.provisioningState	String	The provisioning state of the application gateway resource.
AzureWAF.Policy.properties.policySettings.state	String	The state of the policy.
AzureWAF.Policy.properties.policySettings.mode	String	The mode of the policy.
AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb	Number	Maximum request body size in Kb for WAF.
AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb	Number	Maximum file upload size in Mb for WAF.
AzureWAF.Policy.properties.policySettings.requestBodyCheck	Boolean	Whether to allow WAF to check the request body.
AzureWAF.Policy.properties.customRules.name	String	The name of the resource that is unique within a policy. This name can be used to access the resource.
AzureWAF.Policy.properties.customRules.priority	Number	Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
AzureWAF.Policy.properties.customRules.ruleType	String	The rule type.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName	String	Match variable.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector	String	The selector of the match variable.
AzureWAF.Policy.properties.customRules.matchConditions.operator	String	The operator to be matched.
AzureWAF.Policy.properties.customRules.matchConditions.negationCondition	Boolean	Whether this is a negate condition.
AzureWAF.Policy.properties.customRules.matchConditions.matchValues	String	Match value.
AzureWAF.Policy.properties.customRules.action	String	Type of actions.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType	String	The rule set type to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion	String	The version of the rule set to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName	String	The managed rule group to override.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId	String	Identifier for the managed rule.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state	String	The state of the managed rule. Defaults to disabled if not specified.
AzureWAF.Policy.properties.managedRules.exclusions.matchVariable	String	The variable to be excluded.
AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator	String	When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
AzureWAF.Policy.properties.managedRules.exclusions.selector	String	When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.

Command Example

!azure-waf-policies-get limit=2

Context Example

{
    "AzureWAF": {
        "Policy": [
            {
                "etag": "W/\"4bf9c37a-81b7-4c14-a27c-67962c7af825\"",
                "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
                "location": "example_location",
                "name": "example_policy",
                "properties": {
                    "customRules": [],
                    "managedRules": {
                        "exclusions": [],
                        "managedRuleSets": [
                            {
                                "ruleGroupOverrides": [],
                                "ruleSetType": "OWASP",
                                "ruleSetVersion": "3.0"
                            }
                        ]
                    },
                    "policySettings": {
                        "fileUploadLimitInMb": 750,
                        "maxRequestBodySizeInKb": 128,
                        "mode": "Detection",
                        "requestBodyCheck": true,
                        "state": "Disabled"
                    },
                    "provisioningState": "Succeeded"
                },
                "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
            }
        ]
    }
}

Human Readable Output

Policy: example_policy

etag id location name type

W/”4bf9c37a” /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy westus example_policy Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

Policy: test_policy

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”4e844e6c” | /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/test_policy | westus | test_policy | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 2 policies out of 7

etag	id	location	name	type
W/”4bf9c37a”	/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy	westus	example_policy	Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

azure-waf-policies-list-all-in-subscription

Retrieves all the WAF policies in a subscription.

Base Command

azure-waf-policies-list-all-in-subscription

Input

Argument Name	Description	Required
verbose	Whether to retrieve the full details of the policy. Possible values are “true” and “false”. Default is “false”.	Optional
limit	Maximum number of policies to be shown. (This will only affect visualized data, not context.). Default is 10.	Optional
subscription_id	Comma-separated list of subscription IDs. Will override the default subscription ID.	Optional

Context Output

Path	Type	Description
AzureWAF.Policy.name	String	Resource name.
AzureWAF.Policy.id	String	Resource ID.
AzureWAF.Policy.type	String	Resource type.
AzureWAF.Policy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.Policy.tags	String	Resource tags.
AzureWAF.Policy.location	String	Resource location.
AzureWAF.Policy.properties.resourceState	String	Resource status of the policy.
AzureWAF.Policy.properties.provisioningState	String	The provisioning state of the application gateway resource.
AzureWAF.Policy.properties.policySettings.state	String	The state of the policy.
AzureWAF.Policy.properties.policySettings.mode	String	The mode of the policy.
AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb	Number	Maximum request body size in Kb for WAF.
AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb	Number	Maximum file upload size in Mb for WAF.
AzureWAF.Policy.properties.policySettings.requestBodyCheck	Boolean	Whether to allow WAF to check the request body.
AzureWAF.Policy.properties.customRules.name	String	The name of the resource that is unique within a policy. This name can be used to access the resource.
AzureWAF.Policy.properties.customRules.priority	Number	Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
AzureWAF.Policy.properties.customRules.ruleType	String	The rule type.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName	String	Match variable.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector	String	The selector of the match variable.
AzureWAF.Policy.properties.customRules.matchConditions.operator	String	The operator to be matched.
AzureWAF.Policy.properties.customRules.matchConditions.negationConditon	Boolean	Whether this is a negate condition.
AzureWAF.Policy.properties.customRules.matchConditions.matchValues	String	Match value.
AzureWAF.Policy.properties.customRules.action	String	Type of actions.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType	String	The rule set type to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion	String	The version of the rule set to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName	String	The managed rule group to override.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId	String	Identifier for the managed rule.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state	String	The state of the managed rule. Defaults to disabled if not specified.
AzureWAF.Policy.properties.managedRules.exclusions.matchVariable	String	The variable to be excluded.
AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator	String	When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
AzureWAF.Policy.properties.managedRules.exclusions.selector	String	When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.

Command Example

!azure-waf-policies-list-all-in-subscription limit=2

Context Example

{
    "AzureWAF": {
        "Policy": [
            {
                "etag": "W/\"4bf9c37a-81b7-4c14-a27c-67962c7af825\"",
                "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
                "location": "westus",
                "name": "example_policy",
                "properties": {
                    "customRules": [],
                    "managedRules": {
                        "exclusions": [],
                        "managedRuleSets": [
                            {
                                "ruleGroupOverrides": [],
                                "ruleSetType": "OWASP",
                                "ruleSetVersion": "3.0"
                            }
                        ]
                    },
                    "policySettings": {
                        "fileUploadLimitInMb": 750,
                        "maxRequestBodySizeInKb": 128,
                        "mode": "Detection",
                        "requestBodyCheck": true,
                        "state": "Disabled"
                    },
                    "provisioningState": "Succeeded"
                },
                "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
            }
        ]
    }
}

Human Readable Output

Policy: example_policy

etag id location name type

W/”4bf9c37a” /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy westus example_policy Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

Policy: test_policy_1608641948_

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”422867fc-a697-4978-83f5-20a57ab51511” | /subscriptions/0f907ea4-bc8b-4c11-9d7e-805c2fd144fb/resourceGroups/demisto-sentinel2/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/test_policy_1608641948_ | westus | test_policy_1608641948_ | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 2 policies out of 6

etag	id	location	name	type
W/”4bf9c37a”	/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy	westus	example_policy	Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

azure-waf-policy-update-or-create

Creates or updates a policy with a specified rule set name within a resource group.

Base Command

azure-waf-policy-update-or-create

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.	Required
resource_group_name	Comma-separated list of the names of the resource groups. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional
managed_rules	Describes the managedRules structure.	Required
resource_id	Resource ID.	Optional
location	Describes the resource location.	Optional
custom_rules	The custom rules inside the policy.	Optional
policy_settings	The policy setting for the policy.	Optional
verbose	Whether to retrieve the full details of the policy. Possible values are: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
AzureWAF.Policy.name	String	Resource name.
AzureWAF.Policy.id	String	Resource ID.
AzureWAF.Policy.type	String	Resource type.
AzureWAF.Policy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.Policy.tags	String	Resource type.
AzureWAF.Policy.location	String	Resource location.
AzureWAF.Policy.properties.resourceState	String	Resource status of the policy.
AzureWAF.Policy.properties.provisioningState	String	The provisioning state of the application gateway resource.
AzureWAF.Policy.properties.policySettings.state	String	The state of the policy.
AzureWAF.Policy.properties.policySettings.mode	String	The mode of the policy.
AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb	Number	Maximum request body size in Kb for WAF.
AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb	Number	Maximum file upload size in Mb for WAF.
AzureWAF.Policy.properties.policySettings.requestBodyCheck	Boolean	Whether to allow WAF to check the request body.
AzureWAF.Policy.properties.customRules.name	String	The name of the resource that is unique within a policy. This name can be used to access the resource.
AzureWAF.Policy.properties.customRules.priority	Number	Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
AzureWAF.Policy.properties.customRules.ruleType	String	The rule type.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName	String	Match variable.
AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector	String	The selector of the match variable.
AzureWAF.Policy.properties.customRules.matchConditions.operator	String	The operator to be matched.
AzureWAF.Policy.properties.customRules.matchConditions.negationConditon	Boolean	Whether this is a negate condition.
AzureWAF.Policy.properties.customRules.matchConditions.matchValues	String	Match value.
AzureWAF.Policy.properties.customRules.action	String	Type of actions.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType	String	Defines the rule set type to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion	String	Defines the version of the rule set to use.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName	String	The managed rule group to override.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId	String	Identifier for the managed rule.
AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state	String	The state of the managed rule. Defaults to disabled if not specified.
AzureWAF.Policy.properties.managedRules.exclusions.matchVariable	String	The variable to be excluded.
AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator	String	When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
AzureWAF.Policy.properties.managedRules.exclusions.selector	String	When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.

Command Example

!azure-waf-policy-update-or-create policy_name="example_policy" resource_group_name="demisto-sentinel2" location="WestUs" managed_rules="{ \"managedRuleSets\": [{\"ruleSetType\": \"OWASP\",\"ruleSetVersion\": \"3.0\"}]}"

Context Example

{
    "AzureWAF": {
        "Policy": {
            "etag": "W/\"f1121c83-d9c1-47a4-912b-6f6731c991a4\"",
            "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
            "location": "westus",
            "name": "example_policy",
            "properties": {
                "customRules": [],
                "managedRules": {
                    "exclusions": [],
                    "managedRuleSets": [
                        {
                            "ruleGroupOverrides": [],
                            "ruleSetType": "OWASP",
                            "ruleSetVersion": "3.0"
                        }
                    ]
                },
                "policySettings": {
                    "fileUploadLimitInMb": 100,
                    "maxRequestBodySizeInKb": 128,
                    "mode": "Detection",
                    "requestBodyCheck": true,
                    "state": "Disabled"
                },
                "provisioningState": "Updating"
            },
            "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
        }
    }
}

Human Readable Output

Policy: example_policy

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”f1121c83” | /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy | westus | example_policy | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 1 policies out of 1

azure-waf-policy-delete

Deletes a policy.

Base Command

azure-waf-policy-delete

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.	Required
resource_group_name	The name of the resource group. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional

Context Output

There is no context output for this command.

Command Example

!azure-waf-policy-delete policy_name="example_policy"

Human Readable Output

Policy example_policy was deleted successfully.

azure-waf-front-door-policies-list

Lists all of the Front Door protection policies within a resource group.

Base Command

azure-waf-front-door-policies-list

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.	Optional
resource_group_name	Comma-separated value list of the names of the resource groups. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional
verbose	Whether to retrieve full details of the policy. Possible values are: “true” and “false”. Default is “false”.	Optional
limit	Maximum number of policies to fetch. Default is “10”.	Optional

Context Output

Path	Type	Description
AzureWAF.FrontDoorPolicy.name	String	Resource name.
AzureWAF.FrontDoorPolicy.id	String	Resource ID.
AzureWAF.FrontDoorPolicy.type	String	Resource type.
AzureWAF.FrontDoorPolicy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.FrontDoorPolicy.location	String	Resource location.

Command Example

!azure-waf-front-door-policies-list limit=2

azure-waf-front-door-policies-list-all-in-subscription

Lists all of the Front Door protection policies within a subscription.

Base Command

azure-waf-front-door-policies-list-all-in-subscription

Input

Argument Name	Description	Required
verbose	Whether to retrieve the full details of the policy. Possible values are “true” and “false”. Default is “false”.	Optional
limit	Maximum number of policies to fetch. Default is “10”.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional

Context Output

Path	Type	Description
AzureWAF.FrontDoorPolicy.name	String	Resource name.
AzureWAF.FrontDoorPolicy.id	String	Resource ID.
AzureWAF.FrontDoorPolicy.type	String	Resource type.
AzureWAF.FrontDoorPolicy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.FrontDoorPolicy.location	String	Resource location.

Command Example

!azure-waf-front-door-policies-list-all-in-subscription limit=2

azure-waf-front-door-policy-update-or-create

Creates or updates a Front Door policy with a specified rule set name within a resource group.

Base Command

azure-waf-front-door-policy-update-or-create

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group.	Required
resource_group_name	Comma-separated list of the names of the resource groups. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional
managed_rules	Describes the managedRules structure.	Required
custom_rules	The custom rules inside the policy.	Optional
policy_settings	Describes settings for the policy.	Optional
location	Describes the resource location.	Optional
sku	The pricing tier of web application firewall policy. Defaults to Classic_AzureFrontDoor if not specified. Possible values are: Classic_AzureFrontDoor, Standard_AzureFrontDoor, Premium_AzureFrontDoor. Default is Classic_AzureFrontDoor.	Optional
etag	A unique read-only string that changes whenever the resource is updated.	Optional
verbose	Whether to retrieve the full details of the policy. Possible values are: “true” and “false”. Default is “false”.	Optional
tags	Resource tags.	Optional

Context Output

Path	Type	Description
AzureWAF.FrontDoorPolicy.name	String	Resource name.
AzureWAF.FrontDoorPolicy.id	String	Resource ID.
AzureWAF.FrontDoorPolicy.type	String	Resource type.
AzureWAF.FrontDoorPolicy.etag	String	A unique read-only string that changes whenever the resource is updated.
AzureWAF.FrontDoorPolicy.location	String	Resource location.

Command Example

!azure-waf-front-door-policy-update-or-create policy_name="example_policy" resource_group_name="demisto-sentinel2" location="WestUs" managed_rules="{ \"managedRuleSets\": [{\"ruleSetType\": \"OWASP\",\"ruleSetVersion\": \"3.0\"}]}"

azure-waf-front-door-policy-delete

Deletes a Front Door policy.

Base Command

azure-waf-front-door-policy-delete

Input

Argument Name	Description	Required
policy_name	The name of a policy. Used to retrieve a protection policy with a specified name within a resource group.	Required
resource_group_name	Comma-separated list of the name of the resource group. If not provided, the instance’s default resource group name will be used.	Optional
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional

Context Output

There is no context output for this command.

Command Example

!azure-waf-front-door-policy-delete policy_name="example_policy"

Human Readable Output

Front Door Policy example_policy was deleted successfully.

azure-waf-auth-start

Run this command to start the authorization process and follow the instructions provided in the command results.

Base Command

azure-waf-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!azure-waf-auth-start

Human Readable Output

Authorization instructions

   1. To sign in, use a web browser to open the page:
       [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin)
      and enter the code **CKVE788YV** to authenticate.
   2. Run the **!azure-waf-auth-complete** command in the War Room.

Input

Argument Name	Description	Required
subscription_id	The subscription ID. If not provided, the integration default subscription ID will be used.	Optional
tag	You can filter by tag names and values. For example, to filter for a tag name and value, tagName=tagValue’.	Optional
limit	Maximum number of resource groups to fetch. Default is “50”. Default is 50.	Optional

Context Output

Path	Type	Description
AzureWAF.ResourceGroup.id	String	Resource group ID.
AzureWAF.ResourceGroup.location	String	Resource group location.
AzureWAF.ResourceGroup.name	String	Resource group name.
AzureWAF.ResourceGroup.type	String	Resource group type.
AzureWAF.ResourceGroup.properties	String	Resource group properties.
AzureWAF.ResourceGroup.tags	String	Resource group tags.

Configuration parameters

app_id — App ID
subscription_id — Default Subscription ID (required)
resource_group_name — Default Resource Group Name (required)
auth_type — Authentication Type (required)
tenant_id — Tenant ID
credentials — Client Secret
redirect_uri — Application redirect URI (for authorization code mode)
auth_code — Authorization code
managed_identities_client_id —
azure_ad_endpoint — Azure AD endpoint
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (15)

azure-waf-auth-complete
Run this command to complete the authorization process. Should be used after running the azure_waf-auth-start command.
azure-waf-auth-reset
Run this command if for some reason you need to rerun the authentication process.
azure-waf-auth-start
Run this command to start the authorization process and follow the instructions provided in the command results.
azure-waf-auth-test
Tests connectivity to the Azure Web Application Firewall.
azure-waf-front-door-policies-list
Lists all of the Front Door protection policies within a resource group.
azure-waf-front-door-policies-list-all-in-subscription
Lists all of the Front Door protection policies within a subscription.
azure-waf-front-door-policy-delete
Deletes a Front Door policy.
azure-waf-front-door-policy-update-or-create
Creates or updates a Front Door policy with a specified rule set name within a resource group.
azure-waf-generate-login-url
Generate the login url used for Authorization code flow.
azure-waf-policies-get
Retrieves protection policies within a resource group.
azure-waf-policies-list-all-in-subscription
Retrieves all the WAF policies in a subscription.
azure-waf-policy-delete
Deletes a policy.
azure-waf-policy-update-or-create
Creates or updates a policy with a specified rule set name within a resource group.
azure-waf-resource-group-list
Gets all the resource groups for a subscription.
azure-waf-subscriptions-list
Gets all subscriptions for a tenant.

Source

AzureWAF.py AzureWAF_test.py AzureWAF.yml AzureWAF_description.md command_examples.txt

Download History Raw

category: Network Security
provider: Microsoft
sectionorder:
- Connect
commonfields:
  id: AzureWAF
  version: -1
configuration:
- defaultvalue: cf22fd73-29f1-4245-8e16-533704926d20
  display: App ID
  name: app_id
  type: 0
  section: Connect
  required: false
- display: Default Subscription ID
  name: subscription_id
  required: true
  type: 0
  additionalinfo: Default subscription ID value can be overridden using subscription_id argument to commands.
  section: Connect
- display: Default Resource Group Name
  name: resource_group_name
  required: true
  type: 0
  additionalinfo: Default resource group name can be overridden using resource_group_name argument in commands.
  section: Connect
- additionalinfo: Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, Azure Managed Identities or Client Credentials Flow.
  display: Authentication Type
  name: auth_type
  required: true
  defaultvalue: Device Code
  options:
  - Authorization Code
  - Device Code
  - Azure Managed Identities
  - Client Credentials
  type: 15
  section: Connect
- display: Tenant ID
  name: tenant_id
  type: 0
  section: Connect
  required: false
- display: Client Secret
  displaypassword: Client Secret
  hiddenusername: true
  name: credentials
  type: 9
  section: Connect
  required: false
- display: Application redirect URI (for authorization code mode)
  name: redirect_uri
  type: 0
  section: Connect
  required: false
- display: Authorization code
  displaypassword: Authorization code
  additionalinfo: for Authorization code mode - received from the authorization step. See detailed instructions in the Help section.
  hiddenusername: true
  name: auth_code
  type: 9
  section: Connect
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- defaultvalue: https://login.microsoftonline.com
  display: Azure AD endpoint
  name: azure_ad_endpoint
  options:
  - https://login.microsoftonline.com
  - https://login.microsoftonline.us
  - https://login.microsoftonline.de
  - https://login.chinacloudapi.cn
  type: 15
  additionalinfo: Azure AD endpoint associated with a national cloud.
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: |-
  The Azure WAF (Web Application Firewall) integration provides centralized protection of your web applications from common exploits and vulnerabilities.
  It enables you to control policies that are configured in the Azure Firewall management platform, and allows you to add, delete, or update policies,
  and also to get details of a specific policy or a list of policies.
display: Azure Web Application Firewall
name: AzureWAF
script:
  commands:
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.
      name: policy_name
    - description: Comma-separated value list of the names of the resource groups. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to retrieve full details of the policy. Possible values are: "true" and "false". Default is "false".'
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of policies to fetch. Default is "10".
      name: limit
    description: Retrieves protection policies within a resource group.
    name: azure-waf-policies-get
    outputs:
    - contextPath: AzureWAF.Policy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.Policy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.Policy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.Policy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.Policy.tags
      description: Resource tag.
      type: String
    - contextPath: AzureWAF.Policy.location
      description: Resource location.
      type: String
    - contextPath: AzureWAF.Policy.properties.resourceState
      description: Resource status of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.provisioningState
      description: The provisioning state of the application gateway resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.state
      description: The state of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.mode
      description: The mode of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb
      description: Maximum request body size in Kb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb
      description: Maximum file upload size in Mb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck
      description: Whether to allow WAF to check the request body.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.name
      description: The name of the resource that is unique within a policy. This name can be used to access the resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.priority
      description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
      type: Number
    - contextPath: AzureWAF.Policy.properties.customRules.ruleType
      description: The rule type.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName
      description: Match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector
      description: The selector of the match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator
      description: The operator to be matched.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationCondition
      description: Whether this is a negate condition.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues
      description: Match value.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.action
      description: Type of actions.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType
      description: The rule set type to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion
      description: The version of the rule set to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName
      description: The managed rule group to override.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId
      description: Identifier for the managed rule.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state
      description: The state of the managed rule. Defaults to disabled if not specified.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable
      description: The variable to be excluded.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator
      description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector
      description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to retrieve the full details of the policy. Possible values are "true" and "false". Default is "false".
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of policies to be shown. (This will only affect visualized data, not context.)
      name: limit
    - description: Comma-separated list of subscription IDs. Will override the default subscription ID.
      isArray: true
      name: subscription_id
    description: Retrieves all the WAF policies in a subscription.
    name: azure-waf-policies-list-all-in-subscription
    outputs:
    - contextPath: AzureWAF.Policy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.Policy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.Policy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.Policy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.Policy.tags
      description: Resource tags.
      type: String
    - contextPath: AzureWAF.Policy.location
      description: Resource location.
      type: String
    - contextPath: AzureWAF.Policy.properties.resourceState
      description: Resource status of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.provisioningState
      description: The provisioning state of the application gateway resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.state
      description: The state of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.mode
      description: The mode of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb
      description: Maximum request body size in Kb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb
      description: Maximum file upload size in Mb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck
      description: Whether to allow WAF to check the request body.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.name
      description: The name of the resource that is unique within a policy. This name can be used to access the resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.priority
      description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
      type: Number
    - contextPath: AzureWAF.Policy.properties.customRules.ruleType
      description: The rule type.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName
      description: Match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector
      description: The selector of the match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator
      description: The operator to be matched.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationConditon
      description: Whether this is a negate condition.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues
      description: Match value.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.action
      description: Type of actions.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType
      description: The rule set type to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion
      description: The version of the rule set to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName
      description: The managed rule group to override.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId
      description: Identifier for the managed rule.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state
      description: The state of the managed rule. Defaults to disabled if not specified.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable
      description: The variable to be excluded.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator
      description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector
      description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.
      type: String
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.
      name: policy_name
      required: true
    - description: Comma-separated list of the names of the resource groups. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
    - description: Describes the managedRules structure.
      name: managed_rules
      required: true
    - description: Resource ID.
      name: resource_id
    - description: Describes the resource location.
      name: location
    - description: The custom rules inside the policy.
      name: custom_rules
    - description: The policy setting for the policy.
      name: policy_settings
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to retrieve the full details of the policy. Possible values are: "true" and "false". Default is "false".'
      name: verbose
      predefined:
      - 'true'
      - 'false'
    description: Creates or updates a policy with a specified rule set name within a resource group.
    name: azure-waf-policy-update-or-create
    outputs:
    - contextPath: AzureWAF.Policy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.Policy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.Policy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.Policy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.Policy.tags
      description: Resource type.
      type: String
    - contextPath: AzureWAF.Policy.location
      description: Resource location.
      type: String
    - contextPath: AzureWAF.Policy.properties.resourceState
      description: Resource status of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.provisioningState
      description: The provisioning state of the application gateway resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.state
      description: The state of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.mode
      description: The mode of the policy.
      type: String
    - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb
      description: Maximum request body size in Kb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb
      description: Maximum file upload size in Mb for WAF.
      type: Number
    - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck
      description: Whether to allow WAF to check the request body.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.name
      description: The name of the resource that is unique within a policy. This name can be used to access the resource.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.priority
      description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value.
      type: Number
    - contextPath: AzureWAF.Policy.properties.customRules.ruleType
      description: The rule type.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName
      description: Match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector
      description: The selector of the match variable.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator
      description: The operator to be matched.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationConditon
      description: Whether this is a negate condition.
      type: Boolean
    - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues
      description: Match value.
      type: String
    - contextPath: AzureWAF.Policy.properties.customRules.action
      description: Type of actions.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType
      description: Defines the rule set type to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion
      description: Defines the version of the rule set to use.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName
      description: The managed rule group to override.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId
      description: Identifier for the managed rule.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state
      description: The state of the managed rule. Defaults to disabled if not specified.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable
      description: The variable to be excluded.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator
      description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to.
      type: String
    - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector
      description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to.
      type: String
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.
      name: policy_name
      required: true
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
    - description: Comma-separated list of the name of the resource group. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    description: Deletes a policy.
    name: azure-waf-policy-delete
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies.
      name: policy_name
    - description: Comma-separated value list of the names of the resource groups. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to retrieve full details of the policy. Possible values are: "true" and "false". Default is "false".'
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of policies to fetch. Default is "10".
      name: limit
    description: Lists all of the Front Door protection policies within a resource group.
    name: azure-waf-front-door-policies-list
    outputs:
    - contextPath: AzureWAF.FrontDoorPolicy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.location
      description: Resource location.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to retrieve the full details of the policy. Possible values are "true" and "false". Default is "false".
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '10'
      description: Maximum number of policies to fetch. Default is "10".
      name: limit
    - description: List of subscription IDs. If not provided, the integration default subscription ID will be used.
      name: subscription_id
      isArray: true
    description: Lists all of the Front Door protection policies within a subscription.
    name: azure-waf-front-door-policies-list-all-in-subscription
    outputs:
    - contextPath: AzureWAF.FrontDoorPolicy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.location
      description: Resource location.
      type: String
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group.
      name: policy_name
      required: true
    - description: Comma-separated list of the names of the resource groups. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
      isArray: true
    - description: Describes the managedRules structure.
      name: managed_rules
      required: true
    - description: The custom rules inside the policy in json format.
      name: custom_rules
    - description: Describes settings for the policy.
      name: policy_settings
    - description: Describes the resource location.
      name: location
    - description: The pricing tier of web application firewall policy. Defaults to Classic_AzureFrontDoor if not specified.
      name: sku
      defaultValue: Classic_AzureFrontDoor
    - description: A unique read-only string that changes whenever the resource is updated.
      name: etag
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to retrieve the full details of the policy. Possible values are: "true" and "false". Default is "false".'
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - description: Resource tags.
      isArray: true
      name: tags
    description: Creates or updates a Front Door policy with a specified rule set name within a resource group.
    name: azure-waf-front-door-policy-update-or-create
    outputs:
    - contextPath: AzureWAF.FrontDoorPolicy.name
      description: Resource name.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.id
      description: Resource ID.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.type
      description: Resource type.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.etag
      description: A unique read-only string that changes whenever the resource is updated.
      type: String
    - contextPath: AzureWAF.FrontDoorPolicy.location
      description: Resource location.
      type: String
  - arguments:
    - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group.
      name: policy_name
      required: true
    - description: The subscription ID. If not provided, the integration default subscription ID will be used.
      name: subscription_id
    - description: Comma-separated list of the name of the resource group. If not provided, the instance's default resource group name will be used.
      isArray: true
      name: resource_group_name
    description: Deletes a Front Door policy.
    name: azure-waf-front-door-policy-delete
  - description: |-
      Run this command to start the authorization process and follow the instructions provided in the command results.
    name: azure-waf-auth-start
  - description: |-
      Run this command to complete the authorization process.
      Should be used after running the azure_waf-auth-start command.
    name: azure-waf-auth-complete
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: azure-waf-auth-reset
  - description: Tests connectivity to the Azure Web Application Firewall.
    name: azure-waf-auth-test
  - description: Generate the login url used for Authorization code flow.
    name: azure-waf-generate-login-url
    arguments: []
  - description: Gets all subscriptions for a tenant.
    name: azure-waf-subscriptions-list
    arguments: []
    outputs:
    - contextPath: AzureWAF.Subscription.authorizationSource
      description: Subscription authorization source.
      type: String
    - contextPath: AzureWAF.Subscription.displayName
      description: Subscription display name.
      type: String
    - contextPath: AzureWAF.Subscription.id
      description: Subscription ID with subscriptions prefix.
      type: String
    - contextPath: AzureWAF.Subscription.subscriptionId
      description: Subscription ID.
      type: String
    - contextPath: AzureWAF.Subscription.locationPlacementId
      description: Placement ID of subscription.
      type: String
    - contextPath: AzureWAF.Subscription.tenantId
      description: The tenatnt ID of the subscription.
      type: String
  - description: Gets all the resource groups for a subscription.
    name: azure-waf-resource-group-list
    arguments:
    - description: Comma-separated value list of subscription IDs. If not provided, the integration default subscription ID will be used.
      isArray: true
      name: subscription_id
    - description: The tag name and value by which to filter the results. For example, tagName=tagValue.
      name: tag
    - description: Maximum number of resource groups to fetch.
      defaultValue: 50
      name: limit
    outputs:
    - contextPath: AzureWAF.ResourceGroup.id
      description: Resource group ID.
      type: String
    - contextPath: AzureWAF.ResourceGroup.location
      description: Resource group location.
      type: String
    - contextPath: AzureWAF.ResourceGroup.name
      description: Resource group name.
      type: String
    - contextPath: AzureWAF.ResourceGroup.type
      description: Resource group type.
      type: String
    - contextPath: AzureWAF.ResourceGroup.properties
      description: Resource group properties.
      type: String
    - contextPath: AzureWAF.ResourceGroup.tags
      description: Resource group tags.
      type: String
  dockerimage: demisto/crypto:1.0.0.8931184
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests (auto formatted)

AzureWAF

Details

README

Self-Deployed Application

Required Permissions

Authentication Using the Authorization Code Flow (recommended)

Authentication Using the Device Code Flow

Cortex XSOAR Azure app

Azure Managed Identities Authentication

Note: This option is relevant only if the integration is running on Azure VM

To use System Assigned Managed Identity

To use User Assigned Managed Identity

Client Credentials Flow Authentication

Testing authentication and connectivity

Configure AzureWAF on Cortex XSOAR/XSIAM

Commands

azure-waf-policies-get

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Policy: example_policy

Policy: test_policy

azure-waf-policies-list-all-in-subscription

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Policy: example_policy

Policy: test_policy_1608641948_

azure-waf-policy-update-or-create

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Policy: example_policy

azure-waf-policy-delete

Base Command

Input

Context Output

Command Example

Human Readable Output

azure-waf-front-door-policies-list

Base Command

Input

Context Output

Command Example

azure-waf-front-door-policies-list-all-in-subscription

Base Command

Input

Context Output

Command Example

azure-waf-front-door-policy-update-or-create

Base Command

Input

Context Output

Command Example

azure-waf-front-door-policy-delete

Base Command

Input

Context Output

Command Example

Human Readable Output

azure-waf-auth-start

Base Command

Input

Context Output

Command Example

Human Readable Output

Authorization instructions

azure-waf-auth-complete

Base Command

Input

Context Output