---
title: "Azure Firewall"
slug: "azure-firewall"
updated: 2026-10-30T01:46:20Z
published: 2026-10-30T01:46:20Z
canonical: "docs.databee.buzz/azure-firewall"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Firewall

Azure Firewall is a cloud-native network security service from Microsoft that protects Azure virtual networks and resources by filtering inbound and outbound traffic. It provides centralized traffic control, threat intelligence, and intrusion detection and prevention capabilities. For more information, refer to Microsoft’s official [documentation](https://learn.microsoft.com/en-us/azure/firewall/overview).

**Integration Method**: EventHub

**Tables**: Network Activity (4001), DNS Activity (4003), Detection Finding (2004), Entity Management (3004)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Application Rule | Records of network traffic allowed or denied by Azure Firewall application rules, including HTTP, HTTPS, and other application-level traffic. |
| NAT Rule | Records of network traffic processed by Azure Firewall Network Address Translation (NAT) rules. |
| DNS Query | Records of DNS queries processed by Azure Firewall, including queried domain names and response information. |
| IDPS Signature | Records of traffic matching Intrusion Detection and Prevention System (IDPS) signatures, including detected threats and associated actions. |
| Network Rule | Records of network traffic allowed or denied by Azure Firewall network rules based on IP addresses, ports, and protocols. |
| Activity Log | Records of administrative operations performed on Azure resources, such as resource creation, updates, and deletion, including the operation status and details. |

> [!NOTE]
> **Note:**
> 
> EventHub doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service.

## Prerequisites

- The user should have access to the Azure portal.
- The user should have access to Azure AD to create a diagnostic setting.
- The user should have access to the Event Hub.
- The user should have access to the DataBee console.

## Configuration Overview

1. [Create an Event Hub](/user-manual/docs/azure-firewall#create-eventhub) in the Azure Portal.
2. [Create a diagnostic setting](/user-manual/docs/azure-firewall#create-diagnostic-settings-in-azure-firewall) in Azure Firewall.
3. Get the Event Hub namespace, Event Hub name and [connection string](/user-manual/docs/azure-firewall#get-the-connection-string).
4. Add the Azure Firewall in the DataBee console with the below parameters.

| **DataBee Parameter** | **Azure Firewall Parameter** |
| --- | --- |
| Event Hub Namespace URL | [Event Hub Namespace](/docs/azure-firewall#event_hub_namespace) |
| Event Hub Name | [Event Hub Name](/docs/azure-firewall#event_hub_name) |
| Consumer Group | $Default |
| Connection String | [Connection String](/user-manual/docs/azure-firewall#get-the-connection-string) |

## Azure Configuration

### Create EventHub

1. Sign in to the Azure portal and navigate to Marketplace to create an EventHub. If you have already configured EventHub then skip to [step 7](/docs/azure-firewall#step_7).

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-18oxl7ev.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
2. Provide basic information to create an event hub namespace.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-lrj86yno.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Provide project details which include subscription details.
  2. Enter a valid event hub namespace name. Copy it and save it for later use.
  3. Select the region for your Event Hub namespace.

> [!NOTE]
> **Note:**
> 
> Choose the same region where your Databee cluster is deployed to minimize latency when receiving logs from the Event Hub.
  4. Select the **Pricing Tier**. The **Standard** tier is the minimum requirement, as it’s needed to enable **Apache Kafka** support. For this guide, the **Standard** tier will be used
  5. Provide Throughput Units. For this guide, we will use one (1) Throughput Unit (TU). A higher number may be required in your environment. [More about Throughput Units](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-scalability#throughput-units).
  6. Enable the **Auto-Inflate** option to prevent issues when traffic exceeds the assigned Throughput Unit (TU) capacity. Auto-Inflate automatically increases the number of TUs for your **Standard Tier Event Hubs Namespace** as traffic grows, up to a specified maximum limit.

> [!NOTE]
> **Note:**
> 
> Once **Auto-Inflate** is enabled, capacity does not scale down automatically. You’ll need to manually reduce the TUs if required.
  7. Click on **Next: Advanced >** button.
3. Provide Advance Security Details. Click on **Next: Networking >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-aalmujow.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
4. Select **Public Access** as a Connectivity method. Click **Next: Tags >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-uxhj346m.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
5. Add Tags relevant to your organization for viewing consolidated billing. Click **Next: Review + create >** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-xuri5rrj.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
6. EventHub Namespace.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-zqi1ue6c.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
7. Navigate to Entities > Event Hubs. Click on **+ Event Hub** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-vzucdn87.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
8. Enter basic details to create an Event Hub.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-dekki3su.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Enter valid Event Hub name. Save it for later use.
  2. Specify the Partition count.

> [!NOTE]
> **Note:**
> 
> Partitions enable parallel processing, helping your applications scale. It is recommended to set this between 10-15 for better scalability.
  3. Select Cleanup policy.
  4. Specify the **Retention Period** for the logs.

> [!NOTE]
> **Note:**
> 
> A longer retention period ensures that more logs are retained in Event Hub, reducing the risk of data loss. It is recommended to set the retention period to the maximum allowed value.
  5. Click on the **Review + Create** button.
9. Turn Capture to OFF and click **Next: Review + create >** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-77eqkyhr.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
10. Create an Event Hub. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-4lolkpy7.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D) ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-v9scj2ex.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)

### Create Diagnostic settings in Azure Firewall

**A**. This step is needed to send the Azure firewall logs to Event Hub.

1. Sign in to the Azure Portal
2. Navigate to Diagnostic settings.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-komudv56.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)

> [!NOTE]
> **Note**:
> 
> To create a Diagnostic Setting, the user must have [Security Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#security-administrator) access to create general diagnostic settings for the Microsoft Entra tenant.
  1. Open the **Monitoring** section.
  2. Click on **Diagnostic settings**.
  3. Click on **Add diagnostic setting** button.
3. Enter Diagnostic setting details.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-j90yfqee.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Enter Diagnostic setting name.
  2. Select Log categories, **Azure firewall network rule, NAT rule, DNS query, IDPS Signature** and relevant logs related to your requirement.
  3. Select **Stream to an event hub** option.
  4. Select **Subscription**.
  5. Select **Event hub namespace**.
  6. Select **Event hub name**. (required in our case, to capture logs in one event hub only)
  7. Select **Event hub policy name**.
  8. Click on **Save** button.

**B**. This step is to forward **Azure Firewall Activity** logs to Event hub.

1. Navigate to Activity log.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-i2q3rd93.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Open the **Activity log** section.
  2. Click on **Export Activity log**.
2. Enter Diagnostic setting details.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-6mk5ywbm.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Enter Diagnostic setting name.
  2. Select Log categories, **Azure firewall network rule, NAT rule, DNS query, IDPS Signature** and relevant logs related to your requirement.
  3. Select **Stream to an event hub** option.
  4. Select **Subscription**.
  5. Select **Event hub namespace**.
  6. Select **Event hub name**. (required in our case, to capture logs in one event hub only)
  7. Select **Event hub policy name**.
  8. Click on **Save** button.

### Get the connection string

1. Navigate to Event Hub.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-h9gqt9ir.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
2. Navigate to **Settings** > **Shared access policies**. Click on the **+ Add** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-tnrotqc5.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
3. Add SAS Policy.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-8gtimad4.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Enter valid policy name.
  2. Select Listen option.
  3. Click on **Create** button.
4. Click on the Share policy you created. Copy the **Primary connection string** for later use.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-4c3s6qxv.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-9e74orzz.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
2. Search for **Azure Firewall** and click on it as shown below.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-eo9vc980.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
3. Click on the **Azure Event Hub** collection method.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-gu848pdi.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
4. In configuration, enter the **feed contact information**.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-t8j8dc8p.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
5. Enter **Azure Event Hub connection details**

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-firewall-new-image-db0by7ve.png?sv=2026-02-06&spr=https&st=2026-10-30T10%3A49%3A22Z&se=2026-10-30T11%3A49%3A22Z&sr=c&sp=r&sig=zFPX6ty0PAIXo1gBEBxlS5w6InBflWnNy8EZx1SLA5I%3D)
  1. Replace <Namespace> placeholder with [Event Hub namespace](/docs/azure-firewall#event_hub_namespace).
  2. Enter the Consumer Group, otherwise please keep the default value: “**$Default**”
  3. Enter [Event Hub name](/docs/azure-firewall#event_hub_name).
  4. Select **PLAIN** as Authorization Method.
  5. Enter Event Hub [Connection String](/user-manual/docs/azure-firewall#get-the-connection-string).
6. Click on **Test Connection** button. Once connection is successful, click **Submit**.

## Troubleshooting Tips

- If you are facing an error while testing the connection, then make sure the Event hub namespace, event hub name is the desired one. Make sure the connection string has Listen Claims.