Parsing Azurefirewalllogs Azurediagnostics
KQL detection rule by ep3p · MIT
This query can help you to parse Azure Firewall events received in AzureDiagnostics table. Currently this table is the legacy logging for Azure Firewall and there are other tables that can receive this information. IPv6 is not supported yet by Azure Firewall Click "Save as function", in Parameters write in the fields: string source "" string destination "" int source_port int(null) int destination_port int(null) string action "" string protocol "" bool network_log true bool application_log true bool nat_log true bool ids_log true bool threatintel_log true string firewall "" string policy "" string rule_collection_group "" string rule_collection "" string rule "" If you name the function "AzureFirewallLogs", you can check the function with queries like the following: AzureFirewallLogs() AzureFirewallLogs("10.10.10.237/31", "172.29.55.47/24") let Function = ( destination:string = "", source_port:int = int(null), destination_port:int = int(null), action:string = "", protocol:string = "", network_log:bool = true, application_log:bool = true, nat_log:bool = true, ids_log:bool = true, threatintel_log:bool = true, firewall:string = "", policy:string = "", rule_collection_group:string = "", rule_collection:string = "", rule:string = "" ){ Check inputs
// This query can help you to parse Azure Firewall events received in AzureDiagnostics table.
// Currently this table is the legacy logging for Azure Firewall and there are other tables that can receive this information.
//
// IPv6 is not supported yet by Azure Firewall
//
// Click "Save as function", in Parameters write in the fields:
// string source ""
// string destination ""
// int source_port int(null)
// int destination_port int(null)
// string action ""
// string protocol ""
// bool network_log true
// bool application_log true
// bool nat_log true
// bool ids_log true
// bool threatintel_log true
// string firewall ""
// string policy ""
// string rule_collection_group ""
// string rule_collection ""
// string rule ""
//
// If you name the function "AzureFirewallLogs", you can check the function with queries like the following:
//
// AzureFirewallLogs()
//
// AzureFirewallLogs("10.10.10.237/31", "172.29.55.47/24")
//
//let Function = (
// source:string = "",
// destination:string = "",
// source_port:int = int(null),
// destination_port:int = int(null),
// action:string = "",
// protocol:string = "",
// network_log:bool = true,
// application_log:bool = true,
// nat_log:bool = true,
// ids_log:bool = true,
// threatintel_log:bool = true,
// firewall:string = "",
// policy:string = "",
// rule_collection_group:string = "",
// rule_collection:string = "",
// rule:string = ""
// ){
// Check inputs
let is_source_ipv4 = isnotempty(parse_ipv4(source));
//let is_source_ipv6 = isempty(parse_ipv4(source)) and isnotempty(parse_ipv6(source));
let is_destination_ipv4 = isnotempty(parse_ipv4(destination));
//let is_destination_ipv6 = isempty(parse_ipv4(destination)) and isnotempty(parse_ipv6(destination));
let is_input_valid =
(isempty(source) or is_source_ipv4)// or is_source_ipv6)
//and (isempty(destination) or is_destination_ipv4)// or is_destination_ipv6)
;
// Limit how many different search terms there will be in the "has_any_ipv4_prefix" dynamic, not a literal threshold, higher number -> more limited
let ipv4_search_terms_limit = 2;
// Prepare source address ipv4 search terms
let source_ipv4_netmask_step = ipv4_netmask_suffix(source);
let source_ipv4_netmask = iff(source_ipv4_netmask_step % 8 <= ipv4_search_terms_limit, bin(source_ipv4_netmask_step, 8), source_ipv4_netmask_step);
let source_constant_prefix = iff(bin(source_ipv4_netmask-1, 8)/8 == 0, "", strcat_array(array_slice(split(format_ipv4(source, source_ipv4_netmask), "."), 0, -1 + bin(source_ipv4_netmask-1, 8)/8), "."));
let source_lower_variable_prefix = toint(split(format_ipv4(source, source_ipv4_netmask), ".")[-(1 + bin(32-source_ipv4_netmask, 8)/8)]);
let source_search_terms = split(replace_string(strcat(strcat(iff(source_ipv4_netmask > 8 ,"<<>>", ""), strcat_array(range(source_lower_variable_prefix, toint(source_lower_variable_prefix + pow(2,(-source_ipv4_netmask)% 8)-1)), strcat(iff(source_ipv4_netmask <= 24, ".", ""), "|", iff(source_ipv4_netmask > 8 ,"<<>>", "")))), iff(source_ipv4_netmask between ((ipv4_search_terms_limit + 1) .. 24), ".", "")), "<<>>", strcat(source_constant_prefix, ".")), "|");
// Prepare destination address ipv4 search terms
let destination_ipv4_netmask_step = ipv4_netmask_suffix(destination);
let destination_ipv4_netmask = iff(destination_ipv4_netmask_step % 8 <= ipv4_search_terms_limit, bin(destination_ipv4_netmask_step, 8), destination_ipv4_netmask_step);
let destination_constant_prefix = iff(bin(destination_ipv4_netmask-1, 8)/8 == 0, "", strcat_array(array_slice(split(format_ipv4(destination, destination_ipv4_netmask), "."), 0, -1 + bin(destination_ipv4_netmask-1, 8)/8), "."));
let destination_lower_variable_prefix = toint(split(format_ipv4(destination, destination_ipv4_netmask), ".")[-(1 + bin(32-destination_ipv4_netmask, 8)/8)]);
let destination_search_terms = split(replace_string(strcat(strcat(iff(destination_ipv4_netmask > 8 ,"<<>>", ""), strcat_array(range(destination_lower_variable_prefix, toint(destination_lower_variable_prefix + pow(2,(-destination_ipv4_netmask)% 8)-1)), strcat(iff(destination_ipv4_netmask <= 24, ".", ""), "|", iff(destination_ipv4_netmask > 8 ,"<<>>", "")))), iff(destination_ipv4_netmask between ((ipv4_search_terms_limit + 1) .. 24), ".", "")), "<<>>", strcat(destination_constant_prefix, ".")), "|");
// Prepare source address ipv6 search term
// let source_ipv6_netmask_step = coalesce(toint(extract(@"\/(\d+)$", 1, source)), 128);
// let source_ipv6_netmask = bin(source_ipv6_netmask_step, 16);
// let source_ipv6_search_term = substring(parse_ipv6(source), 0, 5 * source_ipv6_netmask/16);
// Prepare destination address ipv6 search term
// let destination_ipv6_netmask_step = coalesce(toint(extract(@"\/(\d+)$", 1, destination)), 128);
// let destination_ipv6_netmask = bin(destination_ipv6_netmask_step, 16);
// let destination_ipv6_search_term = substring(parse_ipv6(destination), 0, 5 * destination_ipv6_netmask/16);
// Prepare OperationName checks
let removed_logs = set_difference(
array_iff(
pack_array(network_log, application_log, nat_log, ids_log, threatintel_log),
"",
dynamic(["AzureFirewallNetworkRuleLog", "AzureFirewallApplicationRuleLog", "AzureFirewallNatRuleLog", "AzureFirewallIDSLog", "AzureFirewallThreatIntelLog"])
),
dynamic([""])
);
let all_logs = array_length(removed_logs) == 0;
// Query
AzureDiagnostics
// Check input is valid
| where is_input_valid
// Filter by Resource
| where ResourceProvider has "MICROSOFT.NETWORK"
and ResourceType has "AZUREFIREWALLS"
and Category has_any ("AzureFirewallNetworkRule","AzureFirewallApplicationRule")
| where isempty(firewall) or Resource has firewall
| project TimeGenerated, Category, OperationName, msg_s, ResourceId
// Filter by OperationName
| where all_logs or not(OperationName has_any (removed_logs))
// Filter by Action
| where isempty(action) or msg_s has action
// Filter by protocol
| where isempty(protocol) or msg_s has protocol
// Filter by Policy
| where isempty(policy) or msg_s has policy
// Filter by RuleCollectionGroup
| where isempty(rule_collection_group) or msg_s has rule_collection_group
// Filter by RuleCollection
| where isempty(rule_collection) or msg_s has rule_collection
// Filter by Rule
| where isempty(rule) or msg_s has rule
// Filter by addresses
| where isempty(source) or source_ipv4_netmask < 16 or has_any_ipv4_prefix(msg_s, source_search_terms)
| where case(
isempty(destination), true,
is_destination_ipv4, destination_ipv4_netmask < 16 or has_any_ipv4_prefix(msg_s, destination_search_terms),
not(is_destination_ipv4), msg_s has destination,
false
)
// Parse msg_s
| parse msg_s with Protocol " request from " SourceAddress1 ":" SourcePort:int " to " DestinationAddress1 ":" DestinationPort:int *
| parse msg_s with * ". Action: " Action1a "." *
| parse msg_s with * " was " Action1b " to " NatDestinationAddress ":" NatDestinationPort:int "." *
| parse msg_s with Protocol2 " request from " SourceAddress2 " to " DestinationAddress2 ". Action: " Action2 "." *
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup ". Rule Collection: " RuleCollection ". Rule: " Rule
| parse msg_s with * ". ThreatIntel: " ThreatIntel
| extend
FirewallAction = case(isnotempty(Action1a), Action1a, isnotempty(Action1b), Action1b, Action2),
Protocol = iff(isnotempty(Protocol), Protocol, Protocol2),
SourceAddress = iff(isnotempty(SourceAddress1), SourceAddress1, SourceAddress2),
DestinationAddress = iff(isnotempty(DestinationAddress1), DestinationAddress1, DestinationAddress2)
| project TimeGenerated, Category, OperationName, FirewallAction, Protocol, SourceAddress, DestinationAddress, NatDestinationAddress, SourcePort, DestinationPort, NatDestinationPort, Rule, RuleCollection, RuleCollectionGroup, Policy, ThreatIntel, msg_s, ResourceId
// Filter by Action
| where isempty(action) or FirewallAction has action
// Filter by protocol
| where isempty(protocol) or Protocol has protocol
// Filter by Policy
| where isempty(policy) or Policy has policy
// Filter by RuleCollectionGroup
| where isempty(rule_collection_group) or RuleCollectionGroup has rule_collection_group
// Filter by RuleCollection
| where isempty(rule_collection) or RuleCollection has rule_collection
// Filter by Rule
| where isempty(rule) or Rule has rule
// Filter by addresses
| where isempty(source) or ipv4_is_in_range(SourceAddress, source)
| where case(
isempty(destination), true,
is_destination_ipv4, ipv4_is_in_range(DestinationAddress, destination) or ipv4_is_in_range(NatDestinationAddress, destination),
not(is_destination_ipv4), DestinationAddress has destination,
false
)
// Filter by ports, unfortunately ports can have less than 3 characters
| where isempty(source_port) or SourcePort == source_port
| where isempty(destination_port) or DestinationPort == destination_port or NatDestinationPort == destination_port
//};
//Function(source, destination)