Azure Firewall (v1.1.61)
Azure Firewall is a cloud-native and intelligent network firewall security service that provides breed threat protection for cloud workloads running in Azure. It's a fully stateful firewall as a service, with built-in high availability and unrestricted cloud scalability. This pack contains an integration with a main goal to manage Azure Firewall security service, and normalization rules for ingesting and modeling Azure Firewall Resource logs.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Network Security
Integrations (1)
- Azure Firewall
Modeling rules (1)
- Azure Firewall Modeling Rule
Parsing rules (1)
- Azure Firewall Parsing Rule
README
Azure Firewall Pack
What does this pack do
The Azure Firewall pack contains the following:
- Integration capabilities:
- Retrieve or delete firewalls.
- Create, delete and retrieve firewall rule collections.
- Create, delete and retrieve firewall network rules.
- Create, delete and retrieve firewall policies.
- Create, delete and retrieve firewall IP groups.
- Retrieve firewall service tag.
- Data normalization capabilities:
- Rules for parsing and modeling Azure Firewall Resource Logs that are ingested via the Azure Event Hub data source on Cortex XSIAM.
- When configuring the Azure Event Hub data source, mark the following checkbox under the Enhanced Cloud Protection section:
Use audit logs in analytics
- The ingested Azure firewall resource logs can be queried in XQL Search using the
msft_azure_firewall_rawdataset. - Supported log categories:
Category Category Display Name AZFWApplicationRule Azure Firewall Application Rule AZFWApplicationRuleAggregation Azure Firewall Application Rule Aggregation (Policy Analytics) AZFWDnsQuery Azure Firewall DNS query AZFWFatFlow Azure Firewall Fat Flow Log AZFWFlowTrace Azure Firewall Flow Trace Log AZFWFqdnResolveFailure Azure Firewall FQDN Resolution Failure AZFWIdpsSignature Azure Firewall IDPS Signature AZFWNatRule Azure Firewall Nat Rule AZFWNatRuleAggregation Azure Firewall Nat Rule Aggregation (Policy Analytics) AZFWNetworkRule Azure Firewall Network Rule AZFWNetworkRuleAggregation Azure Firewall Network Rule Aggregation (Policy Analytics) AZFWThreatIntel Azure Firewall Threat Intelligence - When configuring the Azure Event Hub data source, mark the following checkbox under the Enhanced Cloud Protection section:
- Rules for parsing and modeling Azure Firewall Resource Logs that are ingested via the Azure Event Hub data source on Cortex XSIAM.