Parsing Azurefirewalllogs Azfw*
KQL detection rule by ep3p · MIT
This query can help you to parse Azure Firewall events received in AZFW tables. Click "Save as function", in Parameters write in the fields: string source "" string destination "" int source_port int(null) int destination_port int(null) string action "" string protocol "" bool network_log true bool application_log true bool nat_log true bool ids_log true bool threatintel_log true string firewall "" If you name the function "AzureFirewallLogs", you can check the function with queries like the following: AzureFirewallLogs() AzureFirewallLogs("10.10.10.237/31", "172.29.55.47/24") let Function = ( destination:string = "", source_port:int = int(null), destination_port:int = int(null), action:string = "", protocol:string = "", network_log:bool = true, application_log:bool = true, nat_log:bool = true, ids_log:bool = true, threatintel_log:bool = true, firewall:string = "" ){ Check inputs
// This query can help you to parse Azure Firewall events received in AZFW tables.
//
// Click "Save as function", in Parameters write in the fields:
// string source ""
// string destination ""
// int source_port int(null)
// int destination_port int(null)
// string action ""
// string protocol ""
// bool network_log true
// bool application_log true
// bool nat_log true
// bool ids_log true
// bool threatintel_log true
// string firewall ""
//
// If you name the function "AzureFirewallLogs", you can check the function with queries like the following:
//
// AzureFirewallLogs()
//
// AzureFirewallLogs("10.10.10.237/31", "172.29.55.47/24")
//
//let Function = (
// source:string = "",
// destination:string = "",
// source_port:int = int(null),
// destination_port:int = int(null),
// action:string = "",
// protocol:string = "",
// network_log:bool = true,
// application_log:bool = true,
// nat_log:bool = true,
// ids_log:bool = true,
// threatintel_log:bool = true,
// firewall:string = ""
// ){
// Check inputs
let is_source_ipv4 = isnotempty(parse_ipv4(source));
let is_source_ipv6 = isempty(parse_ipv4(source)) and isnotempty(parse_ipv6(source));
let is_destination_ipv4 = isnotempty(parse_ipv4(destination));
let is_destination_ipv6 = isempty(parse_ipv4(destination)) and isnotempty(parse_ipv6(destination));
let is_input_valid =
(isempty(source) or is_source_ipv4 or is_source_ipv6)
and (isempty(destination) or is_destination_ipv4 or is_destination_ipv6)
;
// Prepare Type checks
let removed_logs = set_difference(
array_iff(
pack_array(network_log, application_log, nat_log, ids_log, threatintel_log),
"",
dynamic(["AZFWNetworkRule", "AZFWApplicationRule", "AZFWNatRule", "AZFWIdpsSignature", "AZFWThreatIntel"])
),
dynamic([""])
);
let all_logs = array_length(removed_logs) == 0;
// Query
union AZFWNetworkRule, AZFWApplicationRule, AZFWNatRule, AZFWIdpsSignature, AZFWThreatIntel
// Check input is valid
| where is_input_valid
// Filter by Type
| where all_logs or not(Type in (removed_logs))
// Filter by Resource
| where isempty(firewall) or _ResourceId has firewall
// Filter by Action
| where isempty(action) or Action has action// or (Type == "AZFWNatRule" and action =~ "Allow")
// Filter by Protocol
| where isempty(protocol) or Protocol has protocol
// Filter by addresses
| where case(
isempty(source), true,
is_source_ipv4, ipv4_is_in_range(SourceIp, source),
is_source_ipv6, ipv6_is_in_range(SourceIp, source),
false
)
| where case(
isempty(destination), true,
is_destination_ipv4, ipv4_is_in_range(DestinationIp, destination) or ipv4_is_in_range(TranslatedIp, destination),
is_destination_ipv6, ipv6_is_in_range(DestinationIp, destination) or ipv6_is_in_range(TranslatedIp, destination),
TargetUrl has destination
)
// Filter by ports
| where isempty(source_port) or SourcePort == source_port
| where isempty(destination_port) or DestinationPort == destination_port or TranslatedPort == destination_port
| project-reorder TimeGenerated, Type, Action, ActionReason, Protocol, SourceIp, DestinationIp, TranslatedIp, SourcePort, DestinationPort, TranslatedPort, TargetUrl, Fqdn, WebCategory, IsTlsInspected, Rule, RuleCollection, RuleCollectionGroup, Policy, ThreatDescription, Severity, Category, Description, SignatureId, SourceSystem, _ResourceId
//};
//Function(source, destination)