About The Device
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | Microsoft |
Product Name | Azure Firewall |
Type of Device | Cloud |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method | Data Source |
|---|---|---|---|---|
Azure Firewall | AZURE_FIREWALL | Cloud Storage - JSON | CyberHub | https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure_blobstore |
Device Configuration
Prerequisites
An Azure subscription that you can sign in to.
A user who's a Global Administrator
Azure Storage Account to store the logs or an Event Hub to stream the logs.
Reference URLs
How to create storage account: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal
How to configure Event Hub: https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-create
Configuration Steps
Log in to Azure portal, navigate to Firewall Manager → Azure Firewalls
Select Firewall
Navigate to Diagnostic settings
For Azure Firewall, three service-specific legacy logs are available:
- Azure Firewall Application Rule (Legacy Azure Diagnostics)
- Azure Firewall Network Rule (Legacy Azure Diagnostics)
- Azure Firewall Dns Proxy (Legacy Azure Diagnostics)
Click Add diagnostic setting. The Diagnostics settings page provides the settings for the diagnostic logs.
Type a name for the diagnostic setting.
In Logs, under Categories, select Azure Firewall Application Rule (Legacy Azure Diagnostics), Azure Firewall Network Rule (Legacy Azure Diagnostics), and Azure Firewall Dns Proxy (Legacy Azure Diagnostics) to collect the logs.
As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. Adaptive MxDR supports log collection from both the options.
To Configure a Storage Account
Adaptive MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies.
To store logs in Storage Account, select Archive to a storage account and choose an existing Subscription and Storage account.
For the Destination table, select Azure diagnostics.
To Configure EventHub
Select Stream to an event hub.
Select Subscription, Event hub namespace, Event hub name and Event hub policy name created during Event Hub as part of prerequisite.
Select Azure diagnostics in Destination table.
Get credentials of Azure Storage and Azure EventHub: Get Credentials of Azure Storage and Azure EventHub
Integration Parameters
Parameters required from customer for Integration.
Via Azure Storage:
Property | Default Value | Description |
|---|---|---|
Logging Source | N/A | Select Storage |
eventHubConnectionString | N/A | N/A (keep blank) |
consumerGroupName | N/A | N/A (keep blank) |
Account Key | Custome value | Access Key to access storage account |
Blob Container | N/A | Storage blob Container name e.g. |
Storage Account Name | Custome value | Azure storage account name |
Subscription | N/A | Subscription ID that customer wants to be monitored |
initialReadPolicy | N/A | Select Beginning to start reading from beginning and End to start reading logs from the end |
Via Azure EventHub:
Property | Default Value | Description |
|---|---|---|
Logging Source | N/A | Select EventHub |
eventHubConnectionString | N/A | Event hub connection string |
consumerGroupName | N/A | Optional and used if consumer Group is other than default |
Account Key | Custom Value | Access Key to access storage account |
Blob Container | N/A | Storage blob Container name |
Storage Account Name | Custom Value | Azure storage account name |
Subscription | N/A | Set EventHub name |
initialReadPolicy | N/A | N/A (keep default selection) |