Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Azure Firewall

View on GitHub ↗Original file ↗

Description

Connect to Azure Firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220124&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
1
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

AzureDiagnostics (Azure Firewall)AZFWApplicationRuleAZFWFlowTraceAZFWFatFlowAZFWNatRuleAZFWDnsQueryAZFWIdpsSignatureAZFWInternalFqdnResolutionFailureAZFWNetworkRuleAZFWThreatIntel

Declared permissions

read and write permissions.
Workspace
Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect Azure Firewall to Microsoft Sentinel
Enable Diagnostic Logs on All Firewalls.
Inside your Firewall resource: 1. Select **Diagnostic logs.​** 2. Select **+ Add diagnostic setting.​** 3. In the **Diagnostic setting** blade: - Type a **Name**. - Select **Send to Log Analytics**. - Choose the log destination workspace. - Select the categories that you want to analyze ( Azure Firewall Network Rule, Azure Firewall Application Rule,Azure Firewall Nat Rule,Azure Firewall Threat Intelligence,Azure Firewall IDPS Signature,Azure Firewall DNS query,Azure Firewall FQDN Resolution Failure,Azure Firewall Fat Flow Log,Azure Firewall Flow Trace Log) - Click **Save**.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules37
Abnormal Deny Rate for Source IPMediumAbnormal Port to ProtocolMediumAnomaly found in Network Session Traffic (ASIM Network Session schema)MediumDDoS attack detectedHighDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumDNS events related to mining pools (ASIM DNS Schema)LowDNS events related to ToR proxies (ASIM DNS Schema)LowElevation of Privilege attempt detectedHighEuropium - Hash and IP IOCs - September 2022HighExcessive number of failed connections from a single source (ASIM Network Session schema)MediumExcessive NXDOMAIN DNS Queries (ASIM DNS Schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumHigh severity malicious activity detectedHighKnown Forest Blizzard group domains - July 2019HighLog4j vulnerability exploit aka Log4Shell IP IOCHighMedium severity malicious activity detectedMediumMercury - Domain, Hash and IP IOCs - August 2022HighMultiple Sources Affected by the Same TI DestinationMediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort ScanMediumPort scan detected (ASIM Network Session schema)MediumPort SweepMediumPotential beaconing activity (ASIM Network Session schema)LowPotential DGA detected (ASIM DNS Schema)MediumSeveral deny actions registeredMediumStar Blizzard C2 Domains August 2022HighTI Map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map IP entity to AzureFirewallMediumTI Map IP entity to AzureFirewallMediumTI map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumWeb Application attack detectedHigh[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
AzureFirewall
Additional source files 2Solutions/Azure Firewall/Data Connectors/AzureFirewall.JSONsource ↗Solutions/Azure Firewall/Data/Solution_AzureFirewall.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.