Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Azure Firewall

Voir sur GitHub ↗Fichier original ↗

Description

Connect to Azure Firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220124&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Statut déclaré
1
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

AzureDiagnostics (Azure Firewall)AZFWApplicationRuleAZFWFlowTraceAZFWFatFlowAZFWNatRuleAZFWDnsQueryAZFWIdpsSignatureAZFWInternalFqdnResolutionFailureAZFWNetworkRuleAZFWThreatIntel

Permissions déclarées

read and write permissions.
Workspace
Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Connect Azure Firewall to Microsoft Sentinel
Enable Diagnostic Logs on All Firewalls.
Inside your Firewall resource: 1. Select **Diagnostic logs.​** 2. Select **+ Add diagnostic setting.​** 3. In the **Diagnostic setting** blade: - Type a **Name**. - Select **Send to Log Analytics**. - Choose the log destination workspace. - Select the categories that you want to analyze ( Azure Firewall Network Rule, Azure Firewall Application Rule,Azure Firewall Nat Rule,Azure Firewall Threat Intelligence,Azure Firewall IDPS Signature,Azure Firewall DNS query,Azure Firewall FQDN Resolution Failure,Azure Firewall Fat Flow Log,Azure Firewall Flow Trace Log) - Click **Save**.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques37
Abnormal Deny Rate for Source IPMediumAbnormal Port to ProtocolMediumAnomaly found in Network Session Traffic (ASIM Network Session schema)MediumDDoS attack detectedHighDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumDNS events related to mining pools (ASIM DNS Schema)LowDNS events related to ToR proxies (ASIM DNS Schema)LowElevation of Privilege attempt detectedHighEuropium - Hash and IP IOCs - September 2022HighExcessive number of failed connections from a single source (ASIM Network Session schema)MediumExcessive NXDOMAIN DNS Queries (ASIM DNS Schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumHigh severity malicious activity detectedHighKnown Forest Blizzard group domains - July 2019HighLog4j vulnerability exploit aka Log4Shell IP IOCHighMedium severity malicious activity detectedMediumMercury - Domain, Hash and IP IOCs - August 2022HighMultiple Sources Affected by the Same TI DestinationMediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort ScanMediumPort scan detected (ASIM Network Session schema)MediumPort SweepMediumPotential beaconing activity (ASIM Network Session schema)LowPotential DGA detected (ASIM DNS Schema)MediumSeveral deny actions registeredMediumStar Blizzard C2 Domains August 2022HighTI Map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map IP entity to AzureFirewallMediumTI Map IP entity to AzureFirewallMediumTI map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumWeb Application attack detectedHigh[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
AzureFirewall
Autres fichiers source 2Solutions/Azure Firewall/Data Connectors/AzureFirewall.JSONsource ↗Solutions/Azure Firewall/Data/Solution_AzureFirewall.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.