AzureWAF

The Azure WAF (Web Application Firewall) integration provides centralized protection of your web applications from common exploits and vulnerabilities.
It enables you to control policies that are configured in the Azure Firewall management platform, and allows you to add, delete, or update policies,
and also to get details of a specific policy or a list of policies.

In order to connect to the AzureWAF using either Cortex XSOAR Azure App or the Self-Deployed Azure App, use one of the following methods:

• Authorization Code Flow (Recommended).
• Device Code Flow.
• Azure Managed Identities
• Client Credentials Flow.

Self-Deployed Application

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.

Required Permissions

The following API permissions are required in Azure:

Authentication Using the Authorization Code Flow (recommended)

Follow these steps for a self-deployed configuration:

1. To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article steps 1-8.
2. choose the Authorization Code option in the Authentication Type parameter.
3. Enter your Client/Application ID in the Application ID parameter.
4. Enter your Client Secret in the Client Secret parameter.
5. Enter your Tenant ID in the Tenant ID parameter.
6. Enter your Application redirect URI in the Application redirect URI parameter.
7. Save the instance.
8. Run the !azure-waf-generate-login-url command in the War Room and follow the instruction.
9. Run the !azure-waf-auth-test command - a ‘Success’ message should be printed to the War Room.

Authentication Using the Device Code Flow

Use the device code flow
to link Azure SQL Management with Cortex XSOAR.

In order to connect to Azure Web Application Firewall using either the Cortex XSOAR Azure or Self Deployed Azure application:

1. Fill in the required parameters
2. choose the Device Code option in the Authentication Type parameter.
3. Run the !azure-waf-auth-start command.
4. Follow the instructions that appear.
5. Run the !azure-waf-auth-complete command.
   At end of the process, you will see a message that you logged in successfully.

Cortex XSOAR Azure app

In order to use the Cortex XSOAR Azure application, use the default application ID (cf22fd73-29f1-4245-8e16-533704926d20) and fill in your subscription ID and default resource group name.

You only need to fill in your subscription ID and resource group name. You can find your resource group and
subscription ID in the Azure Portal. For a more detailed explanation, visit this page.

Azure Managed Identities Authentication

Note: This option is relevant only if the integration is running on Azure VM

Follow one of these steps for authentication based on Azure Managed Identities:

• To use System Assigned Managed Identity

  • In the Authentication Type drop-down list, select Azure Managed Identities and leave the Azure Managed Identities Client ID field empty.

• To use User Assigned Managed Identity

  1. Go to Azure Portal -> Managed Identities.
  2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the Azure Managed Identities client id field in the instance configuration.
  3. In the Authentication Type drop-down list, select Azure Managed Identities.

For more information, see Managed identities for Azure resources.

Client Credentials Flow Authentication

Assign Azure roles using the Azure portal Microsoft article
Note: In the Select members section, assign the application you created earlier.
To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:

1. In the Authentication Type field, select the Client Credentials option.
2. In the Application ID field, enter your Client/Application ID.
3. In the Tenant ID field, enter your Tenant ID .
4. In the Client Secret field, enter your Client Secret.
5. Click Test to validate the URLs, token, and connection
6. Save the instance.

Testing authentication and connectivity

If you are using Device Code Flow or Authorization Code Flow, for testing your authentication and connectivity to the AzureWAF service run the !azure-waf-auth-test command.

Configure AzureWAF on Cortex XSOAR/XSIAM

1. Navigate to one of the following:
   • Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances
   • Cortex XSOAR 6: Settings > Integrations > Servers & Services.
   • Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations
2. Search for Azure Web Application Firewall.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   App ID		False
   Default Subscription ID		True
   Default Resource Group Name		True
   Authentication Type	Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, or Azure Managed Identities.	True
   Tenant ID (for authorization code mode)		False
   Client Secret (for authorization code mode)		False
   Client Secret (for authorization code mode)		False
   Application redirect URI (for authorization code mode)		False
   Authorization code	for user-auth mode - received from the authorization step. see Detailed Instructions (?) section	False
   Authorization code		False
   Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False
   Azure AD endpoint	Azure AD endpoint associated with a national cloud.	False
   Trust any certificate (not secure)		False
   Use system proxy settings		False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-waf-policies-get

Retrieves protection policies within a resource group.

Base Command

azure-waf-policies-get

Input

Context Output

Command Example

!azure-waf-policies-get limit=2

Context Example

{
    "AzureWAF": {
        "Policy": [
            {
                "etag": "W/\"4bf9c37a-81b7-4c14-a27c-67962c7af825\"",
                "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
                "location": "example_location",
                "name": "example_policy",
                "properties": {
                    "customRules": [],
                    "managedRules": {
                        "exclusions": [],
                        "managedRuleSets": [
                            {
                                "ruleGroupOverrides": [],
                                "ruleSetType": "OWASP",
                                "ruleSetVersion": "3.0"
                            }
                        ]
                    },
                    "policySettings": {
                        "fileUploadLimitInMb": 750,
                        "maxRequestBodySizeInKb": 128,
                        "mode": "Detection",
                        "requestBodyCheck": true,
                        "state": "Disabled"
                    },
                    "provisioningState": "Succeeded"
                },
                "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
            }
        ]
    }
}

Human Readable Output

Policy: example_policy

etag	id	location	name	type
W/”4bf9c37a”	/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy	westus	example_policy	Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

Policy: test_policy

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”4e844e6c” | /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/test_policy | westus | test_policy | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 2 policies out of 7

azure-waf-policies-list-all-in-subscription

Retrieves all the WAF policies in a subscription.

Base Command

azure-waf-policies-list-all-in-subscription

Input

Context Output

Command Example

!azure-waf-policies-list-all-in-subscription limit=2

Context Example

{
    "AzureWAF": {
        "Policy": [
            {
                "etag": "W/\"4bf9c37a-81b7-4c14-a27c-67962c7af825\"",
                "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
                "location": "westus",
                "name": "example_policy",
                "properties": {
                    "customRules": [],
                    "managedRules": {
                        "exclusions": [],
                        "managedRuleSets": [
                            {
                                "ruleGroupOverrides": [],
                                "ruleSetType": "OWASP",
                                "ruleSetVersion": "3.0"
                            }
                        ]
                    },
                    "policySettings": {
                        "fileUploadLimitInMb": 750,
                        "maxRequestBodySizeInKb": 128,
                        "mode": "Detection",
                        "requestBodyCheck": true,
                        "state": "Disabled"
                    },
                    "provisioningState": "Succeeded"
                },
                "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
            }
        ]
    }
}

Human Readable Output

Policy: example_policy

etag	id	location	name	type
W/”4bf9c37a”	/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy	westus	example_policy	Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies

Policy: test_policy_1608641948_

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”422867fc-a697-4978-83f5-20a57ab51511” | /subscriptions/0f907ea4-bc8b-4c11-9d7e-805c2fd144fb/resourceGroups/demisto-sentinel2/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/test_policy_1608641948_ | westus | test_policy_1608641948_ | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 2 policies out of 6

azure-waf-policy-update-or-create

Creates or updates a policy with a specified rule set name within a resource group.

Base Command

azure-waf-policy-update-or-create

Input

Context Output

Command Example

!azure-waf-policy-update-or-create policy_name="example_policy" resource_group_name="demisto-sentinel2" location="WestUs" managed_rules="{ \"managedRuleSets\": [{\"ruleSetType\": \"OWASP\",\"ruleSetVersion\": \"3.0\"}]}"

Context Example

{
    "AzureWAF": {
        "Policy": {
            "etag": "W/\"f1121c83-d9c1-47a4-912b-6f6731c991a4\"",
            "id": "/subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy",
            "location": "westus",
            "name": "example_policy",
            "properties": {
                "customRules": [],
                "managedRules": {
                    "exclusions": [],
                    "managedRuleSets": [
                        {
                            "ruleGroupOverrides": [],
                            "ruleSetType": "OWASP",
                            "ruleSetVersion": "3.0"
                        }
                    ]
                },
                "policySettings": {
                    "fileUploadLimitInMb": 100,
                    "maxRequestBodySizeInKb": 128,
                    "mode": "Detection",
                    "requestBodyCheck": true,
                    "state": "Disabled"
                },
                "provisioningState": "Updating"
            },
            "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
        }
    }
}

Human Readable Output

Policy: example_policy

|etag|id|location|name|type|
|—|—|—|—|—|
| W/”f1121c83” | /subscriptions/example_subscription/resourceGroups/example_resource_group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/example_policy | westus | example_policy | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies |
Showing 1 policies out of 1

azure-waf-policy-delete

Deletes a policy.

Base Command

azure-waf-policy-delete

Input

Context Output

There is no context output for this command.

Command Example

!azure-waf-policy-delete policy_name="example_policy"

Human Readable Output

Policy example_policy was deleted successfully.

azure-waf-front-door-policies-list

Lists all of the Front Door protection policies within a resource group.

Base Command

azure-waf-front-door-policies-list

Input

Context Output

Command Example

!azure-waf-front-door-policies-list limit=2

azure-waf-front-door-policies-list-all-in-subscription

Lists all of the Front Door protection policies within a subscription.

Base Command

azure-waf-front-door-policies-list-all-in-subscription

Input

Context Output

Command Example

!azure-waf-front-door-policies-list-all-in-subscription limit=2

azure-waf-front-door-policy-update-or-create

Creates or updates a Front Door policy with a specified rule set name within a resource group.

Base Command

azure-waf-front-door-policy-update-or-create

Input

Context Output

Command Example

!azure-waf-front-door-policy-update-or-create policy_name="example_policy" resource_group_name="demisto-sentinel2" location="WestUs" managed_rules="{ \"managedRuleSets\": [{\"ruleSetType\": \"OWASP\",\"ruleSetVersion\": \"3.0\"}]}"

azure-waf-front-door-policy-delete

Deletes a Front Door policy.

Base Command

azure-waf-front-door-policy-delete

Input

Context Output

There is no context output for this command.

Command Example

!azure-waf-front-door-policy-delete policy_name="example_policy"

Human Readable Output

Front Door Policy example_policy was deleted successfully.

azure-waf-auth-start

Run this command to start the authorization process and follow the instructions provided in the command results.

Base Command

azure-waf-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!azure-waf-auth-start

Human Readable Output

Authorization instructions

   1. To sign in, use a web browser to open the page:
       [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin)
      and enter the code **CKVE788YV** to authenticate.
   2. Run the **!azure-waf-auth-complete** command in the War Room.

azure-waf-auth-complete

Run this command to complete the authorization process.
Should be used after running the azure_waf-auth-start command.

Base Command

azure-waf-auth-complete

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!azure-waf-auth-complete

Human Readable Output

✅ Authorization completed successfully.

azure-waf-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

azure-waf-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!azure-waf-auth-reset

Human Readable Output

Authorization was reset successfully. You can now run !azure-waf-auth-start and !azure-waf-auth-complete.

azure-waf-auth-test

Tests connectivity to the Azure Web Application Firewall.

Base Command

azure-waf-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!azure-waf-auth-test

Human Readable Output

✅ Great Success!

azure-waf-generate-login-url

Generate the login url used for Authorization code flow.

Base Command

azure-waf-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

azure-waf-generate-login-url

Human Readable Output

Authorization instructions

1. Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
   You will be automatically redirected to a link with the following structure:
   REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE
2. Copy the AUTH_CODE (without the code= prefix, and the session_state parameter)
   and paste it in your instance configuration under the Authorization code parameter.

azure-waf-subscriptions-list

Gets all subscriptions for a tenant.

Base Command

azure-waf-subscriptions-list

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

azure-waf-resource-group-list

Gets all the resource groups for a subscription.

Base Command

azure-waf-resource-group-list

Input

Context Output