{
  "Name": "Azure Firewall",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AzFirewalls.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Azure Firewall](https://docs.microsoft.com/azure/firewall/overview) solution for Microsoft Sentinel enables ingestion of DNS Proxy, Application Rule and Network Rule [logs](https://docs.microsoft.com/azure/firewall/logs-and-metrics) from Azure Firewalls.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Azure Monitor Resource Diagnostics](https://docs.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal)",
  "Workbooks": [
    "Workbooks/AzureFirewallWorkbook.json",
	"Workbooks/AzureFirewallWorkbook-StructuredLogs.json"
  ],
  "Data Connectors": [
    "Data Connectors/AzureFirewall.json"
  ],
  "Playbooks": [
	"Playbooks/AzureFirewallConnector/azuredeploy.json",
	"Playbooks/AzureFirewall-BlockIP-addToIPGroup/azuredeploy.json",
	"Playbooks/AzureFirewall-AddIPtoTIAllowList/azuredeploy.json",
	"Playbooks/AzureFirewall-BlockIP-addNewRule/azuredeploy.json"
  ],
  "Hunting Queries": [
    "Hunting Queries/Azure Firewall - First Time Source IP to Destination Using Port.yaml",
    "Hunting Queries/Azure Firewall - First time source IP to Destination.yaml",
    "Hunting Queries/Azure Firewall - Source IP Abnormally Connects to Multiple Destinations.yaml",
    "Hunting Queries/Azure Firewall - Uncommon Port for Organization.yaml",
    "Hunting Queries/Azure Firewall - Uncommon Port to IP.yaml"
  ],
  "Analytic Rules": [
	"Analytic Rules/SeveralDenyActionsRegistered.yaml",
	"Analytic Rules/Azure Firewall - Port Sweep.yaml",
	"Analytic Rules/Azure Firewall - Port Scan.yaml",
	"Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml",
	"Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml",
	"Analytic Rules/Azure Firewall - Abnormal Deny Rate for Source IP.yaml",
  "Analytic Rules/Azure Firewall - DDoS attack detected.yaml",
  "Analytic Rules/Azure Firewall - Elevation of Privilege attempt detected.yaml",
  "Analytic Rules/Azure Firewall - High severity malicious activity detected.yaml",
  "Analytic Rules/Azure Firewall - Medium severity malicious activity detected.yaml",
  "Analytic Rules/Azure Firewall - Web Application attack detected.yaml"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Firewall",
  "Version": "3.0.7",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "StaticDataConnectorIds": [
    "AzureFirewall"
  ]
}