How to find azure firewall rules using KQL

Question

Hi Team,

We are currently having an azure firewall in place and also diagnostic settings are enabled to log the information in Log Analytics Workspace.

However, when I run the below query I'm not getting any results:

AzureActivity | where OperationNameValue == 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE'

Requesting you to help if there is any alternate way to find out the firewall rules along with action type.

Answer 1

Hello @Mohit Kumar ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand you have deployed an Azure Firewall and the diagnostic settings are enabled for it to log the information in Log Analytics Workspace and you would like to know how to get the firewall rules along with action type.

When you open Azure Monitor Log Analytics, you have access to existing log queries.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/queries#queries-dialog

You can find the query packs in Azure Monitor logs/Log analytics workspace logs for any Azure resource/service which allows logging. So, Azure Firewall log query pack can be found as below:

The overall Azure Firewall log query would be as below:

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"

If you have more than one Azure Firewall in your subscription, do specify the Firewall name:

AzureDiagnostics 
| where Category == "AzureFirewallNetworkRule" 
    and Resource  == "FirewallName"

Or you can modify the query pack as per your requirement to get specific logs.

I modified and ran the "Azure Firewall log data" (highlighted in the above screenshot) query from the existing query samples and below is the result I got:

Adding the query that I used for your reference below:

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"
| extend msg_original = msg_s
| extend msg_s = replace(@'. Action: Deny. Reason: SNI TLS extension was missing.', @' to no_data:no_data. Action: Deny. Rule Collection: default behavior. Rule: SNI TLS extension missing', msg_s)
| extend msg_s = replace(@'No rule matched. Proceeding with default action', @'Rule Collection: default behavior. Rule: no rule matched', msg_s)
| parse msg_s with * " Web Category: " WebCategory
| extend msg_s = replace(@'(. Web Category:).*','', msg_s)
| parse msg_s with * ". Rule Collection: " RuleCollection ". Rule: " Rule
| extend msg_s = replace(@'(. Rule Collection:).*','', msg_s)
| parse msg_s with * ". Rule Collection Group: " RuleCollectionGroup
| extend msg_s = replace(@'(. Rule Collection Group:).*','', msg_s)
| parse msg_s with * ". Policy: " Policy
| extend msg_s = replace(@'(. Policy:).*','', msg_s)
| parse msg_s with Protocol " request from " SourceIP " to " Target ". Action: " Action
| extend 
    SourceIP = iif(SourceIP contains ":",strcat_array(split(SourceIP,":",0),""),SourceIP),
    SourcePort = iif(SourceIP contains ":",strcat_array(split(SourceIP,":",1),""),""),
    Target = iif(Target contains ":",strcat_array(split(Target,":",0),""),Target),
    TargetPort = iif(SourceIP contains ":",strcat_array(split(Target,":",1),""),""),
    Action = iif(Action contains ".",strcat_array(split(Action,".",0),""),Action),
    Policy = case(RuleCollection contains ":", split(RuleCollection, ":")[0] ,Policy),
    RuleCollectionGroup = case(RuleCollection contains ":", split(RuleCollection, ":")[1], RuleCollectionGroup),
    RuleCollection = case(RuleCollection contains ":", split(RuleCollection, ":")[2], RuleCollection)
| project msg_original,TimeGenerated,Protocol,SourceIP,SourcePort,Target,TargetPort,Action,OperationName,Policy,RuleCollectionGroup,RuleCollection,Rule,WebCategory
| order by TimeGenerated
| limit 100

The above logs are the "Azure diagnostics" logs or the legacy logs which are explained in the below doc:

https://learn.microsoft.com/en-us/azure/firewall/firewall-diagnostics

If you have enabled the new "structured logs" or "resource specific logs", then keep in mind this feature is currently in PREVIEW.

Currently, the following diagnostic log categories are available for Azure Firewall:

• Application rule log
• Network rule log
• DNS proxy log

These log categories use Azure diagnostics mode. In this mode, all data from any diagnostic setting will be collected in the AzureDiagnostics table.

By default, the new resource specific tables are disabled.

If you want to enable Azure Firewall Structured logs, you need to register the feature using PowerShell commands as explained in the below doc:

https://learn.microsoft.com/en-us/azure/firewall/firewall-structured-logs#enabledisable-structured-logs

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Could you try using this query:

AzureDiagnostics
| where Category == "AzureFirewallApplicationRule" or Category == "AzureFirewallNetworkRule"
| where ResourceProvider == "MICROSOFT.NETWORK"
| extend ruleType = iff(Category == "AzureFirewallApplicationRule", "Application Rule", "Network Rule")
| extend actionType = tostring(parse_json(Properties).action)
| project TimeGenerated, ruleType, actionType, ResourceGroup, ResourceId, ResourceName