Azure Firewall

Azure Firewall is a cloud-native network security service from Microsoft that protects Azure virtual networks and resources by filtering inbound and outbound traffic. It provides centralized traffic control, threat intelligence, and intrusion detection and prevention capabilities.
For more information, refer to Microsoft’s official documentation.

Integration Method: EventHub

Tables: Network Activity (4001), DNS Activity (4003), Detection Finding (2004), Entity Management (3004)

This integration supports the following events.

Event	Description
Application Rule	Records of network traffic allowed or denied by Azure Firewall application rules, including HTTP, HTTPS, and other application-level traffic.
NAT Rule	Records of network traffic processed by Azure Firewall Network Address Translation (NAT) rules.
DNS Query	Records of DNS queries processed by Azure Firewall, including queried domain names and response information.
IDPS Signature	Records of traffic matching Intrusion Detection and Prevention System (IDPS) signatures, including detected threats and associated actions.
Network Rule	Records of network traffic allowed or denied by Azure Firewall network rules based on IP addresses, ports, and protocols.
Activity Log	Records of administrative operations performed on Azure resources, such as resource creation, updates, and deletion, including the operation status and details.

Note:
EventHub doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service.

Prerequisites

The user should have access to the Azure portal.
The user should have access to Azure AD to create a diagnostic setting.
The user should have access to the Event Hub.
The user should have access to the DataBee console.

Configuration Overview

Create an Event Hub in the Azure Portal.
Create a diagnostic setting in Azure Firewall.
Get the Event Hub namespace, Event Hub name and connection string.
Add the Azure Firewall in the DataBee console with the below parameters.
DataBee Parameter
Azure Firewall Parameter
Event Hub Namespace URL
Event Hub Namespace
Event Hub Name
Event Hub Name
Consumer Group
$Default
Connection String
Connection String

DataBee Parameter	Azure Firewall Parameter
Event Hub Namespace URL	Event Hub Namespace
Event Hub Name	Event Hub Name
Consumer Group	$Default
Connection String	Connection String

Azure Configuration

Create EventHub

Sign in to the Azure portal and navigate to Marketplace to create an EventHub. If you have already configured EventHub then skip to step 7.
Provide basic information to create an event hub namespace.
1. Provide project details which include subscription details.
2. Enter a valid event hub namespace name. Copy it and save it for later use.
3. Select the region for your Event Hub namespace.
  Note:
  Choose the same region where your Databee cluster is deployed to minimize latency when receiving logs from the Event Hub.
4. Select the Pricing Tier. The Standard tier is the minimum requirement, as it’s needed to enable Apache Kafka support. For this guide, the Standard tier will be used
5. Provide Throughput Units. For this guide, we will use one (1) Throughput Unit (TU). A higher number may be required in your environment. More about Throughput Units.
6. Enable the Auto-Inflate option to prevent issues when traffic exceeds the assigned Throughput Unit (TU) capacity. Auto-Inflate automatically increases the number of TUs for your Standard Tier Event Hubs Namespace as traffic grows, up to a specified maximum limit.
  Note:
  Once Auto-Inflate is enabled, capacity does not scale down automatically. You’ll need to manually reduce the TUs if required.
7. Click on Next: Advanced > button.
Provide Advance Security Details. Click on Next: Networking > button.
Select Public Access as a Connectivity method. Click Next: Tags > button.
Add Tags relevant to your organization for viewing consolidated billing. Click Next: Review + create > button.
EventHub Namespace.
Navigate to Entities > Event Hubs. Click on + Event Hub button.
Enter basic details to create an Event Hub.
1. Enter valid Event Hub name. Save it for later use.
2. Specify the Partition count.
  Note:
  Partitions enable parallel processing, helping your applications scale. It is recommended to set this between 10-15 for better scalability.
3. Select Cleanup policy.
4. Specify the Retention Period for the logs.
  Note:
  A longer retention period ensures that more logs are retained in Event Hub, reducing the risk of data loss. It is recommended to set the retention period to the maximum allowed value.
5. Click on the Review + Create button.
Turn Capture to OFF and click Next: Review + create > button.
Create an Event Hub.

Create Diagnostic settings in Azure Firewall

A. This step is needed to send the Azure firewall logs to Event Hub.

Sign in to the Azure Portal
Navigate to Diagnostic settings.
1. Open the Monitoring section.
2. Click on Diagnostic settings.
3. Click on Add diagnostic setting button.
Note:
To create a Diagnostic Setting, the user must have Security Administrator access to create general diagnostic settings for the Microsoft Entra tenant.
Enter Diagnostic setting details.
1. Enter Diagnostic setting name.
2. Select Log categories, Azure firewall network rule, NAT rule, DNS query, IDPS Signature and relevant logs related to your requirement.
3. Select Stream to an event hub option.
4. Select Subscription.
5. Select Event hub namespace.
6. Select Event hub name. (required in our case, to capture logs in one event hub only)
7. Select Event hub policy name.
8. Click on Save button.

B. This step is to forward Azure Firewall Activity logs to Event hub.

Navigate to Activity log.
1. Open the Activity log section.
2. Click on Export Activity log.
Enter Diagnostic setting details.
1. Enter Diagnostic setting name.
2. Select Log categories, Azure firewall network rule, NAT rule, DNS query, IDPS Signature and relevant logs related to your requirement.
3. Select Stream to an event hub option.
4. Select Subscription.
5. Select Event hub namespace.
6. Select Event hub name. (required in our case, to capture logs in one event hub only)
7. Select Event hub policy name.
8. Click on Save button.

Get the connection string

Navigate to Event Hub.
Navigate to Settings > Shared access policies. Click on the + Add button.
Add SAS Policy.
1. Enter valid policy name.
2. Select Listen option.
3. Click on Create button.
Click on the Share policy you created. Copy the Primary connection string for later use.

DataBee Configuration

Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
Search for Azure Firewall and click on it as shown below.
Click on the Azure Event Hub collection method.
In configuration, enter the feed contact information.
Enter Azure Event Hub connection details
1. Replace <Namespace> placeholder with Event Hub namespace.
2. Enter the Consumer Group, otherwise please keep the default value: “$Default”
3. Enter Event Hub name.
4. Select PLAIN as Authorization Method.
5. Enter Event Hub Connection String.
Click on Test Connection button. Once connection is successful, click Submit.

Troubleshooting Tips

If you are facing an error while testing the connection, then make sure the Event hub namespace, event hub name is the desired one. Make sure the connection string has Listen Claims.