Azfwlogs

azure Firewall Logs

Network rules

Legacy

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where OperationName == "AzureFirewallNetworkRuleLog"
| parse msg_s with Protocol " request from " SourceIP ":" SourcePort:int " to " Target":" TargetPort:int *
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup "." *
| parse msg_s with * " Rule Collection: "  RuleCollection ". Rule: " Rule
| parse kind=regex flags=U msg_s with * ". Action\\: " Action "\\."
| project TimeGenerated, msg_s, Protocol, SourceIP,SourcePort,Target,TargetPort,Action,Policy,RuleCollectionGroup,Rule

New Azure Diagnostics

AzureDiagnostics
| where Category == "AZFWNetworkRule"
| project TimeGenerated, msg_s, Protocol_s, SourceIP,SourcePort_d,DestinationIp_s,DestinationPort_d,Action_s,Policy_s,RuleCollectionGroup_s,Rule_s

No legacy

  AZFWNetworkRule
| project TimeGenerated, Protocol, SourceIp,SourcePort,DestinationIp,DestinationPort,Action,Policy,RuleCollectionGroup,Rule

| where ipv4_is_in_range(SourceIp, “10.0.0.0/20”)

NAT rules

Legacy

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where OperationName == "AzureFirewallNatRuleLog"
| parse msg_s with Protocol " request from " SourceIP ":" SourcePort:int " to " TargetIP ":" TargetPort:int *
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup "." *
| parse msg_s with * " Rule Collection: "  RuleCollection ". Rule: " Rule
| parse msg_s with * " was " Action:string " to " TranslatedDestination:string ":" TranslatedPort:int *
| project TimeGenerated, msg_s, Protocol, SourceIP,SourcePort,TargetIP,TargetPort,Action,TranslatedDestination,TranslatedPort,Policy,RuleCollectionGroup,Rule

New Azure Diagnostics

AzureDiagnostics
| where Category == "AZFWNatRule"
| project TimeGenerated, msg_s, Protocol_s, SourceIP,SourcePort_d,DestinationIp_s,DestinationPort_d,TranslatedIp_s,TranslatedPort_d,Policy_s,RuleCollectionGroup_s,Rule_s

No legacy

AZFWNatRule
| project TimeGenerated, Protocol,
SourceIp,SourcePort,DestinationIp,DestinationPort,TranslatedIp,TranslatedPort,Policy,RuleCollectionGroup,RuleCollection,Rule

App rules

Legacy

AzureDiagnostics
| where Category == "AzureFirewallApplicationRule"
| parse msg_s with Protocol " request from " SourceIP ":" SourcePort:int " to " Target ":" TargetPort:int *
| parse kind=regex flags=U msg_s with * ". Action\\: " Action "\\."
| parse msg_s with * ". Policy: " Policy ". Rule Collection Group: " RuleCollectionGroup "." *
| parse msg_s with * " Rule Collection: "  RuleCollection ". Rule: " Rule
| project TimeGenerated, msg_s, Protocol, SourceIP,SourcePort,Target,TargetPort,Action,Policy,RuleCollectionGroup,Rule

New Azure Diagnostics

AzureDiagnostics
| where Category == "AZFWApplicationRule"
| project TimeGenerated, msg_s, Protocol_s, SourceIP,SourcePort_d,DestinationIp_s,Fqdn_s,DestinationPort_d,IsTlsInspected_b,Action_s,Policy_s,RuleCollectionGroup_s,Rule_s

No legacy

AZFWApplicationRule
| project TimeGenerated,Protocol, SourceIp,SourcePort,Fqdn,DestinationPort,IsTlsInspected,Action,Policy,RuleCollectionGroup,Rule