{
    "id": "AzureFirewall",
    "title": "Azure Firewall",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Connect to Azure Firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220124&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "lastDataReceivedInfoBalloon": "If no new data has been received in the last 14 days, the connector will display as being \"not connected.\" When the connector will recive data , the \"connected\" status will return.",
    "logo": "AzureFirewall.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "AzureDiagnostics",
            "baseQuery": "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\""
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWApplicationRule",
            "baseQuery": "AZFWApplicationRule"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWFlowTrace",
            "baseQuery": "AZFWFlowTrace"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWFatFlow",
            "baseQuery": "AZFWFatFlow"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWNatRule",
            "baseQuery": "AZFWNatRule"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWDnsQuery",
            "baseQuery": "AZFWDnsQuery"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWIdpsSignature",
            "baseQuery": "AZFWIdpsSignature"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWInternalFqdnResolutionFailure",
            "baseQuery": "AZFWInternalFqdnResolutionFailure"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWNetworkRule",
            "baseQuery": "AZFWNetworkRule"
        },
        {
            "metricName": "Total data received",
            "legend": "AZFWThreatIntel",
            "baseQuery": "AZFWThreatIntel"
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\"\n            | sort by TimeGenerated"
        },
        {
            "description": "Threat Intel Matches",
            "query": "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\"\n            | where OperationName == \"AzureFirewallThreatIntelLog\""
        },
        {
            "description": "Log Parser",
            "query": "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\"\n            | parse msg_s with Protocol_s 'request from ' SourceHost_s ':' SourcePort_s 'to ' DestinationHost_s ':' DestinationPort_s 'was' Action_s 'to' DNATDestination\n                | parse msg_s with Protocol_S 'request from ' SourceHost_S ':' SourcePort_S 'to ' DestinationHost_S ':' DestinationPort_S '. Action:' Action_S\n                | extend Protocol = strcat(Protocol_s, Protocol_S), SourceHost = strcat(SourceHost_s, SourceHost_S),SourcePort = strcat(SourcePort_s, SourcePort_S), DestinationHost = strcat(DestinationHost_s, DestinationHost_S), DestinationPort = strcat(DestinationPort_s, DestinationPort_S), Action = strcat(Action_s, Action_S)\n                | project TimeGenerated , Protocol , SourceHost , SourcePort , DestinationHost , DestinationPort , DNATDestination , Action , Resource , ResourceGroup , SubscriptionId , OperationName , msg_s\n                | sort by TimeGenerated desc"
        },
        {
            "description": "Azure Firewall flow trace logs",
            "query": "AZFWFlowTrace | where Flag == \"INVALID\"\n            | order by TimeGenerated desc\n | take 100"
        },
        {
            "description": "Threat intelligence logs",
            "query": "AZFWThreatIntel\n            | take 1000\n            | sort by TimeGenerated"
        },
        {
            "description": "Azure Firewall Top Flow Logs",
            "query": "AZFWFatFlow   | take 1000\n        | order by TimeGenerated desc"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\"\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWApplicationRule\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWFlowTrace\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWFatFlow\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWNatRule\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWDnsQuery\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWIdpsSignature\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWInternalFqdnResolutionFailure\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWNetworkRule\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AZFWThreatIntel\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "AzureDiagnostics (Azure Firewall)",
            "lastDataReceivedQuery": "AzureDiagnostics | where ResourceType == \"AZUREFIREWALLS\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWApplicationRule",
            "lastDataReceivedQuery": "AZFWApplicationRule\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWFlowTrace",
            "lastDataReceivedQuery": "AZFWFlowTrace\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWFatFlow",
            "lastDataReceivedQuery": "AZFWFatFlow\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWNatRule",
            "lastDataReceivedQuery": "AZFWNatRule\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWDnsQuery",
            "lastDataReceivedQuery": "AZFWDnsQuery\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWIdpsSignature",
            "lastDataReceivedQuery": "AZFWIdpsSignature\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWInternalFqdnResolutionFailure",
            "lastDataReceivedQuery": "AZFWInternalFqdnResolutionFailure\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWNetworkRule",
            "lastDataReceivedQuery": "AZFWNetworkRule\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AZFWThreatIntel",
            "lastDataReceivedQuery": "AZFWThreatIntel\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Azure Firewall to Microsoft Sentinel",
            "description": "Enable Diagnostic Logs on All Firewalls.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenAzureFirewall"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "",
            "description": "Inside your Firewall resource:\n\n1.  Select **Diagnostic logs.​**\n2.  Select **+ Add diagnostic setting.​**\n3.  In the **Diagnostic setting** blade:\n    -   Type a **Name**.\n    -   Select **Send to Log Analytics**.\n    -   Choose the log destination workspace.\n    -   Select the categories that you want to analyze ( Azure Firewall Network Rule, Azure Firewall Application Rule,Azure Firewall Nat Rule,Azure Firewall Threat Intelligence,Azure Firewall IDPS Signature,Azure Firewall DNS query,Azure Firewall FQDN Resolution Failure,Azure Firewall Fat Flow Log,Azure Firewall Flow Trace Log)\n    -   Click **Save**."
        }
    ]
}