category: Network Security provider: Microsoft sectionorder: - Connect commonfields: id: AzureWAF version: -1 configuration: - defaultvalue: cf22fd73-29f1-4245-8e16-533704926d20 display: App ID name: app_id type: 0 section: Connect required: false - display: Default Subscription ID name: subscription_id required: true type: 0 additionalinfo: Default subscription ID value can be overridden using subscription_id argument to commands. section: Connect - display: Default Resource Group Name name: resource_group_name required: true type: 0 additionalinfo: Default resource group name can be overridden using resource_group_name argument in commands. section: Connect - additionalinfo: Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, Azure Managed Identities or Client Credentials Flow. display: Authentication Type name: auth_type required: true defaultvalue: Device Code options: - Authorization Code - Device Code - Azure Managed Identities - Client Credentials type: 15 section: Connect - display: Tenant ID name: tenant_id type: 0 section: Connect required: false - display: Client Secret displaypassword: Client Secret hiddenusername: true name: credentials type: 9 section: Connect required: false - display: Application redirect URI (for authorization code mode) name: redirect_uri type: 0 section: Connect required: false - display: Authorization code displaypassword: Authorization code additionalinfo: for Authorization code mode - received from the authorization step. See detailed instructions in the Help section. hiddenusername: true name: auth_code type: 9 section: Connect required: false - additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID name: managed_identities_client_id hiddenusername: true type: 9 section: Connect required: false - defaultvalue: https://login.microsoftonline.com display: Azure AD endpoint name: azure_ad_endpoint options: - https://login.microsoftonline.com - https://login.microsoftonline.us - https://login.microsoftonline.de - https://login.chinacloudapi.cn type: 15 additionalinfo: Azure AD endpoint associated with a national cloud. section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false description: |- The Azure WAF (Web Application Firewall) integration provides centralized protection of your web applications from common exploits and vulnerabilities. It enables you to control policies that are configured in the Azure Firewall management platform, and allows you to add, delete, or update policies, and also to get details of a specific policy or a list of policies. display: Azure Web Application Firewall name: AzureWAF script: commands: - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies. name: policy_name - description: Comma-separated value list of the names of the resource groups. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id - auto: PREDEFINED defaultValue: 'false' description: 'Whether to retrieve full details of the policy. Possible values are: "true" and "false". Default is "false".' name: verbose predefined: - 'true' - 'false' - defaultValue: '10' description: Maximum number of policies to fetch. Default is "10". name: limit description: Retrieves protection policies within a resource group. name: azure-waf-policies-get outputs: - contextPath: AzureWAF.Policy.name description: Resource name. type: String - contextPath: AzureWAF.Policy.id description: Resource ID. type: String - contextPath: AzureWAF.Policy.type description: Resource type. type: String - contextPath: AzureWAF.Policy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.Policy.tags description: Resource tag. type: String - contextPath: AzureWAF.Policy.location description: Resource location. type: String - contextPath: AzureWAF.Policy.properties.resourceState description: Resource status of the policy. type: String - contextPath: AzureWAF.Policy.properties.provisioningState description: The provisioning state of the application gateway resource. type: String - contextPath: AzureWAF.Policy.properties.policySettings.state description: The state of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.mode description: The mode of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb description: Maximum request body size in Kb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb description: Maximum file upload size in Mb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck description: Whether to allow WAF to check the request body. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.name description: The name of the resource that is unique within a policy. This name can be used to access the resource. type: String - contextPath: AzureWAF.Policy.properties.customRules.priority description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. type: Number - contextPath: AzureWAF.Policy.properties.customRules.ruleType description: The rule type. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName description: Match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector description: The selector of the match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator description: The operator to be matched. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationCondition description: Whether this is a negate condition. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues description: Match value. type: String - contextPath: AzureWAF.Policy.properties.customRules.action description: Type of actions. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType description: The rule set type to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion description: The version of the rule set to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName description: The managed rule group to override. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId description: Identifier for the managed rule. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state description: The state of the managed rule. Defaults to disabled if not specified. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable description: The variable to be excluded. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to. type: String - arguments: - auto: PREDEFINED defaultValue: 'false' description: Whether to retrieve the full details of the policy. Possible values are "true" and "false". Default is "false". name: verbose predefined: - 'true' - 'false' - defaultValue: '10' description: Maximum number of policies to be shown. (This will only affect visualized data, not context.) name: limit - description: Comma-separated list of subscription IDs. Will override the default subscription ID. isArray: true name: subscription_id description: Retrieves all the WAF policies in a subscription. name: azure-waf-policies-list-all-in-subscription outputs: - contextPath: AzureWAF.Policy.name description: Resource name. type: String - contextPath: AzureWAF.Policy.id description: Resource ID. type: String - contextPath: AzureWAF.Policy.type description: Resource type. type: String - contextPath: AzureWAF.Policy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.Policy.tags description: Resource tags. type: String - contextPath: AzureWAF.Policy.location description: Resource location. type: String - contextPath: AzureWAF.Policy.properties.resourceState description: Resource status of the policy. type: String - contextPath: AzureWAF.Policy.properties.provisioningState description: The provisioning state of the application gateway resource. type: String - contextPath: AzureWAF.Policy.properties.policySettings.state description: The state of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.mode description: The mode of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb description: Maximum request body size in Kb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb description: Maximum file upload size in Mb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck description: Whether to allow WAF to check the request body. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.name description: The name of the resource that is unique within a policy. This name can be used to access the resource. type: String - contextPath: AzureWAF.Policy.properties.customRules.priority description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. type: Number - contextPath: AzureWAF.Policy.properties.customRules.ruleType description: The rule type. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName description: Match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector description: The selector of the match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator description: The operator to be matched. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationConditon description: Whether this is a negate condition. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues description: Match value. type: String - contextPath: AzureWAF.Policy.properties.customRules.action description: Type of actions. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType description: The rule set type to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion description: The version of the rule set to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName description: The managed rule group to override. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId description: Identifier for the managed rule. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state description: The state of the managed rule. Defaults to disabled if not specified. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable description: The variable to be excluded. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to. type: String - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies. name: policy_name required: true - description: Comma-separated list of the names of the resource groups. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id - description: Describes the managedRules structure. name: managed_rules required: true - description: Resource ID. name: resource_id - description: Describes the resource location. name: location - description: The custom rules inside the policy. name: custom_rules - description: The policy setting for the policy. name: policy_settings - auto: PREDEFINED defaultValue: 'false' description: 'Whether to retrieve the full details of the policy. Possible values are: "true" and "false". Default is "false".' name: verbose predefined: - 'true' - 'false' description: Creates or updates a policy with a specified rule set name within a resource group. name: azure-waf-policy-update-or-create outputs: - contextPath: AzureWAF.Policy.name description: Resource name. type: String - contextPath: AzureWAF.Policy.id description: Resource ID. type: String - contextPath: AzureWAF.Policy.type description: Resource type. type: String - contextPath: AzureWAF.Policy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.Policy.tags description: Resource type. type: String - contextPath: AzureWAF.Policy.location description: Resource location. type: String - contextPath: AzureWAF.Policy.properties.resourceState description: Resource status of the policy. type: String - contextPath: AzureWAF.Policy.properties.provisioningState description: The provisioning state of the application gateway resource. type: String - contextPath: AzureWAF.Policy.properties.policySettings.state description: The state of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.mode description: The mode of the policy. type: String - contextPath: AzureWAF.Policy.properties.policySettings.maxRequestBodySizeInKb description: Maximum request body size in Kb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.fileUploadLimitInMb description: Maximum file upload size in Mb for WAF. type: Number - contextPath: AzureWAF.Policy.properties.policySettings.requestBodyCheck description: Whether to allow WAF to check the request body. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.name description: The name of the resource that is unique within a policy. This name can be used to access the resource. type: String - contextPath: AzureWAF.Policy.properties.customRules.priority description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. type: Number - contextPath: AzureWAF.Policy.properties.customRules.ruleType description: The rule type. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.variableName description: Match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchVariables.selector description: The selector of the match variable. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.operator description: The operator to be matched. type: String - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.negationConditon description: Whether this is a negate condition. type: Boolean - contextPath: AzureWAF.Policy.properties.customRules.matchConditions.matchValues description: Match value. type: String - contextPath: AzureWAF.Policy.properties.customRules.action description: Type of actions. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetType description: Defines the rule set type to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleSetVersion description: Defines the version of the rule set to use. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.ruleGroupName description: The managed rule group to override. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.ruleId description: Identifier for the managed rule. type: String - contextPath: AzureWAF.Policy.properties.managedRules.managedRuleSets.ruleGroupOverrides.rules.state description: The state of the managed rule. Defaults to disabled if not specified. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.matchVariable description: The variable to be excluded. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selectorMatchOperator description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to. type: String - contextPath: AzureWAF.Policy.properties.managedRules.exclusions.selector description: When matchVariable is a collection, the operator used to specify which elements in the collection this exclusion applies to. type: String - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies. name: policy_name required: true - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id - description: Comma-separated list of the name of the resource group. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name description: Deletes a policy. name: azure-waf-policy-delete - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. If policy_name is not provided, will retrieve all policies. name: policy_name - description: Comma-separated value list of the names of the resource groups. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id - auto: PREDEFINED defaultValue: 'false' description: 'Whether to retrieve full details of the policy. Possible values are: "true" and "false". Default is "false".' name: verbose predefined: - 'true' - 'false' - defaultValue: '10' description: Maximum number of policies to fetch. Default is "10". name: limit description: Lists all of the Front Door protection policies within a resource group. name: azure-waf-front-door-policies-list outputs: - contextPath: AzureWAF.FrontDoorPolicy.name description: Resource name. type: String - contextPath: AzureWAF.FrontDoorPolicy.id description: Resource ID. type: String - contextPath: AzureWAF.FrontDoorPolicy.type description: Resource type. type: String - contextPath: AzureWAF.FrontDoorPolicy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.FrontDoorPolicy.location description: Resource location. type: String - arguments: - auto: PREDEFINED defaultValue: 'false' description: Whether to retrieve the full details of the policy. Possible values are "true" and "false". Default is "false". name: verbose predefined: - 'true' - 'false' - defaultValue: '10' description: Maximum number of policies to fetch. Default is "10". name: limit - description: List of subscription IDs. If not provided, the integration default subscription ID will be used. name: subscription_id isArray: true description: Lists all of the Front Door protection policies within a subscription. name: azure-waf-front-door-policies-list-all-in-subscription outputs: - contextPath: AzureWAF.FrontDoorPolicy.name description: Resource name. type: String - contextPath: AzureWAF.FrontDoorPolicy.id description: Resource ID. type: String - contextPath: AzureWAF.FrontDoorPolicy.type description: Resource type. type: String - contextPath: AzureWAF.FrontDoorPolicy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.FrontDoorPolicy.location description: Resource location. type: String - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. name: policy_name required: true - description: Comma-separated list of the names of the resource groups. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id isArray: true - description: Describes the managedRules structure. name: managed_rules required: true - description: The custom rules inside the policy in json format. name: custom_rules - description: Describes settings for the policy. name: policy_settings - description: Describes the resource location. name: location - description: The pricing tier of web application firewall policy. Defaults to Classic_AzureFrontDoor if not specified. name: sku defaultValue: Classic_AzureFrontDoor - description: A unique read-only string that changes whenever the resource is updated. name: etag - auto: PREDEFINED defaultValue: 'false' description: 'Whether to retrieve the full details of the policy. Possible values are: "true" and "false". Default is "false".' name: verbose predefined: - 'true' - 'false' - description: Resource tags. isArray: true name: tags description: Creates or updates a Front Door policy with a specified rule set name within a resource group. name: azure-waf-front-door-policy-update-or-create outputs: - contextPath: AzureWAF.FrontDoorPolicy.name description: Resource name. type: String - contextPath: AzureWAF.FrontDoorPolicy.id description: Resource ID. type: String - contextPath: AzureWAF.FrontDoorPolicy.type description: Resource type. type: String - contextPath: AzureWAF.FrontDoorPolicy.etag description: A unique read-only string that changes whenever the resource is updated. type: String - contextPath: AzureWAF.FrontDoorPolicy.location description: Resource location. type: String - arguments: - description: The name of a policy. Used to retrieve a protection policy with a specified name within a resource group. name: policy_name required: true - description: The subscription ID. If not provided, the integration default subscription ID will be used. name: subscription_id - description: Comma-separated list of the name of the resource group. If not provided, the instance's default resource group name will be used. isArray: true name: resource_group_name description: Deletes a Front Door policy. name: azure-waf-front-door-policy-delete - description: |- Run this command to start the authorization process and follow the instructions provided in the command results. name: azure-waf-auth-start - description: |- Run this command to complete the authorization process. Should be used after running the azure_waf-auth-start command. name: azure-waf-auth-complete - description: Run this command if for some reason you need to rerun the authentication process. name: azure-waf-auth-reset - description: Tests connectivity to the Azure Web Application Firewall. name: azure-waf-auth-test - description: Generate the login url used for Authorization code flow. name: azure-waf-generate-login-url arguments: [] - description: Gets all subscriptions for a tenant. name: azure-waf-subscriptions-list arguments: [] outputs: - contextPath: AzureWAF.Subscription.authorizationSource description: Subscription authorization source. type: String - contextPath: AzureWAF.Subscription.displayName description: Subscription display name. type: String - contextPath: AzureWAF.Subscription.id description: Subscription ID with subscriptions prefix. type: String - contextPath: AzureWAF.Subscription.subscriptionId description: Subscription ID. type: String - contextPath: AzureWAF.Subscription.locationPlacementId description: Placement ID of subscription. type: String - contextPath: AzureWAF.Subscription.tenantId description: The tenatnt ID of the subscription. type: String - description: Gets all the resource groups for a subscription. name: azure-waf-resource-group-list arguments: - description: Comma-separated value list of subscription IDs. If not provided, the integration default subscription ID will be used. isArray: true name: subscription_id - description: The tag name and value by which to filter the results. For example, tagName=tagValue. name: tag - description: Maximum number of resource groups to fetch. defaultValue: 50 name: limit outputs: - contextPath: AzureWAF.ResourceGroup.id description: Resource group ID. type: String - contextPath: AzureWAF.ResourceGroup.location description: Resource group location. type: String - contextPath: AzureWAF.ResourceGroup.name description: Resource group name. type: String - contextPath: AzureWAF.ResourceGroup.type description: Resource group type. type: String - contextPath: AzureWAF.ResourceGroup.properties description: Resource group properties. type: String - contextPath: AzureWAF.ResourceGroup.tags description: Resource group tags. type: String dockerimage: demisto/crypto:1.0.0.8931184 runonce: false script: '-' subtype: python3 type: python fromversion: 5.0.0 tests: - No tests (auto formatted)