Overview

The Azure Firewall integration ingests diagnostic logs published by an Azure Firewall instance, including:

  • AzureFirewallApplicationRule — application rule hits (URL, FQDN)
  • AzureFirewallNetworkRule — network rule hits (5-tuple)
  • AzureFirewallDnsProxy — DNS resolution events
  • AzureFirewallThreatIntelLog — Microsoft Threat Intelligence matches

Logs are routed through an Event Hub to Atatus.

Prerequisites

  • An Azure Firewall instance.
  • An Event Hub namespace and hub with a Listen policy (see Azure Event Hub).

Step 1: Configure Azure Firewall diagnostic settings

  1. Open the Azure portal and navigate to your Azure Firewall resource.
  2. Go to Monitoring → Diagnostic settings → Add diagnostic setting.
  3. Name it atatus-siem.
  4. Select the log categories:
    • AzureFirewallApplicationRule
    • AzureFirewallNetworkRule
    • AzureFirewallDnsProxy
    • AzureFirewallThreatIntelLog
  5. Under Destination details, choose Stream to an event hub and select your namespace, hub, and a Listen-capable Shared Access Policy.
  6. Click Save.

Step 2: Connect Azure Firewall in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Azure Firewall card and click Connect.
  3. Fill in the form:
Field Description Example
Connection String Event Hub Listen connection string. Endpoint=sb://...
Event Hub Name Hub receiving the firewall logs. insights-logs-azfw
Consumer Group Dedicated consumer group for Atatus. atatus
Tenant ID Azure AD tenant ID. 00000000-0000-0000-0000-000000000000
Subscription ID Subscription containing the firewall. 11111111-1111-1111-1111-111111111111
Poll Interval (minutes) How often to read new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The Azure Firewall card shows Configured.
  • Firewall events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_firewall.