Azure Firewall

Introduction

Azure Firewall is a cloud-native, scalable, and highly available security service that provides network traffic filtering and threat protection. It helps safeguard your resources by enforcing security rules, inspecting traffic, and preventing unauthorized access to ensure a secure and compliant network environment.

Getting Started

Compatibility

The Azure Firewall O11ySource supports Azure Firewall Services within standard lifecycle support.

Data Collection Method

Telemetry data for Azure Firewall comprises various metrics that monitor event processing performance, resource utilization, and operational health. Our internal agent, deployed within the Vusmartmaps environment, collects these metrics using a pull method.

Prerequisites

Dependent Configuration

To configure this O11ySource, create a 'credential' of type 'azure' under the 'Definition' tab.

Inputs for Configuring Data Source

• Resource Name: Enter the Resource Name of Firewall
• Resource ID: A unique identifier for the Azure resource.
• Credential: Client ID, Client Secret, Subscription ID and Tenant ID associated to the credential.
• Period (in seconds): Time interval for polling data from the Azure Event Hub. Period should be between 60 seconds – 3000 seconds.

Firewall Requirement

To collect data from this O11ySource, ensure the following ports are opened:

Source IP	Destination IP	Destination Port	Protocol	Direction
vuSmartMaps IP	Azure Monitor IP	443*	TCP	Outbound

*Before providing the firewall requirements, please update the port based on the customer environment.

Configuring the Target

Health and performance metrics of Azure Firewall Services are collected through Azure Monitor service. Thus, Azure Monitor must be enabled in your Azure account. Azure Firewall Services should have available instances for which monitoring is enabled.

An IAM role or user with the following permissions to access Azure Firewall metrics through Azure Monitor:

• Grant the Azure AD application, for which you've obtained the Client ID and Client Secret, the "Reader" role or a custom role specifically assigned with the Microsoft.Insights/metrics/read permission.

Configuration Steps

"*Enable the O11ySource.

• Select the sources tab and press the + button to add a new instance that has to be monitored.
• Provide the required configurations:
• *Resource Name
• *Resource ID
• *Credential
• *Period (in seconds)
• Click Save to close the data source window."

Metrics Collected

Name	Description	Data Type
name	Metric name of the Azure resource (e.g., firewall throughput, dropped packets, etc.).	String
timestamp	Precise timestamp of the agent with milliseconds	DateTime64
target	The specific Azure Firewall instance or entity being measured.	String
resource_group	Resource group in Azure	String
namespace	The namespace for Azure Firewall metrics (e.g., Microsoft.Network/azurefirewalls).	String
resource_name	Name of the Azure resource (Azure Management API)	String
resource_region	The Azure region where the firewall instance is deployed.	String
subscription_id	Azure subscription identifier	String
unit	Unit of measurement for the metric (e.g., bytes, packets, requests per second).	String
minimum	Minimum value of the metric over the period	Float64
maximum	Maximum value of the metric over the period	Float64
total	Total value of the metric over the period	Float64
average	Average value of the metric over the period	Float64
count	Indicate the number of occurrences or events of a specific type within a given time frame.	UInt64