Detection: Network Firewall Rule Created or Updated

Overview

Detect when a rule in an Azure Firewall policy was created or updated. Firewall rules control the flow of traffic and enforce security boundaries, and unauthorized changes can lead to security vulnerabilities or operational disruptions. Monitoring these updates ensures consistent enforcement of security policies and prevents unauthorized modifications.

References:

Azure Firewall Policy Rule Management

Usage

Run the detection in your terminal:

powerpipe detection run azure_activity_log_detections.detection.network_firewall_rule_created_or_updated

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run azure_activity_log_detections.detection.network_firewall_rule_created_or_updated --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
operation_name as operation,
resource_id as resource,
caller as actor,
tp_index::varchar as subscription_id,
resource_group_name as resource_group,
tp_id as source_id,
status as event_status,
*

from
  azure_activity_log
where
  operation_name = 'Microsoft.Network/firewallPolicies/ruleGroups/write'
  and status = 'Succeeded'

order by
  timestamp desc;

Detection: Network Firewall Rule Created or Updated

Overview

Usage

SQL

Tags