Skip to main content

Azure Firewall

Download With Dependencies

Azure Firewall is a cloud-native and intelligent network firewall security service that provides breed threat protection for cloud workloads running in Azure. It's a fully stateful firewall as a service, with built-in high availability and unrestricted cloud scalability. This pack contains an integration with a main goal to manage Azure Firewall security service, and normalization rules for ingesting and modeling Azure Firewall Resource logs.

Azure Firewall Pack

What does this pack do

The Azure Firewall pack contains the following:

  • Integration capabilities:

    • Retrieve or delete firewalls.
    • Create, delete and retrieve firewall rule collections.
    • Create, delete and retrieve firewall network rules.
    • Create, delete and retrieve firewall policies.
    • Create, delete and retrieve firewall IP groups.
    • Retrieve firewall service tag.

  • Data normalization capabilities:

    • Rules for parsing and modeling Azure Firewall Resource Logs that are ingested via the Azure Event Hub data source on Cortex XSIAM.
    • When configuring the Azure Event Hub data source, mark the following checkbox under the Enhanced Cloud Protection section:
      • Use audit logs in analytics
    • The ingested Azure firewall resource logs can be queried in XQL Search using the msft_azure_firewall_raw dataset.
    • Supported log categories:
    Category Category Display Name
    AZFWApplicationRule Azure Firewall Application Rule
    AZFWApplicationRuleAggregation Azure Firewall Application Rule Aggregation (Policy Analytics)
    AZFWDnsQuery Azure Firewall DNS query
    AZFWFatFlow Azure Firewall Fat Flow Log
    AZFWFlowTrace Azure Firewall Flow Trace Log
    AZFWFqdnResolveFailure Azure Firewall FQDN Resolution Failure
    AZFWIdpsSignature Azure Firewall IDPS Signature
    AZFWNatRule Azure Firewall Nat Rule
    AZFWNatRuleAggregation Azure Firewall Nat Rule Aggregation (Policy Analytics)
    AZFWNetworkRule Azure Firewall Network Rule
    AZFWNetworkRuleAggregation Azure Firewall Network Rule Aggregation (Policy Analytics)
    AZFWThreatIntel Azure Firewall Threat Intelligence

Azure Firewall Pack

What does this pack do

The Azure Firewall pack contains the following:

  • Integration capabilities:

    • Retrieve or delete firewalls.
    • Create, delete and retrieve firewall rule collections.
    • Create, delete and retrieve firewall network rules.
    • Create, delete and retrieve firewall policies.
    • Create, delete and retrieve firewall IP groups.
    • Retrieve firewall service tag.

  • Data normalization capabilities:

    • Rules for parsing and modeling Azure Firewall Resource Logs that are ingested via the Azure Event Hub data source on Cortex XSIAM.
    • When configuring the Azure Event Hub data source, mark the following checkbox under the Enhanced Cloud Protection section:
      • Use audit logs in analytics
    • The ingested Azure firewall resource logs can be queried in XQL Search using the msft_azure_firewall_raw dataset.
    • Supported log categories:
    Category Category Display Name
    AZFWApplicationRule Azure Firewall Application Rule
    AZFWApplicationRuleAggregation Azure Firewall Application Rule Aggregation (Policy Analytics)
    AZFWDnsQuery Azure Firewall DNS query
    AZFWFatFlow Azure Firewall Fat Flow Log
    AZFWFlowTrace Azure Firewall Flow Trace Log
    AZFWFqdnResolveFailure Azure Firewall FQDN Resolution Failure
    AZFWIdpsSignature Azure Firewall IDPS Signature
    AZFWNatRule Azure Firewall Nat Rule
    AZFWNatRuleAggregation Azure Firewall Nat Rule Aggregation (Policy Analytics)
    AZFWNetworkRule Azure Firewall Network Rule
    AZFWNetworkRuleAggregation Azure Firewall Network Rule Aggregation (Policy Analytics)
    AZFWThreatIntel Azure Firewall Threat Intelligence

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedMay 2, 2022
Last ReleaseDecember 9, 2024
Network Security
WORKS WITH THE FOLLOWING INTEGRATIONS:
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.