You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Today, the following diagnostic log categories are available for Azure Firewall:
63
-
- Application rule log
64
-
- Network rule log
65
-
- DNS proxy log
62
+
With Structured Firewall Logs, you'll be able to choose to use Resource Specific tables instead of an existing AzureDiagnostics table. Structured Firewall Logs is required for Policy Analytics. This new method helps you with better log querying and is recommended because:
66
63
67
-
These log categories use [Azure diagnostics mode](../azure-monitor/essentials/resource-logs.md#azure-diagnostics-mode). In this mode, all data from any diagnostic setting will be collected in the [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table.
64
+
- It's easier to work with the data in the log queries
65
+
- It's easier to discover schemas and their structure
66
+
- It improves performance across both ingestion latency and query times
67
+
- It allows you to grant Azure RBAC rights on a specific table
68
68
69
-
With this new feature, you'll be able to choose to use [Resource Specific Tables](../azure-monitor/essentials/resource-logs.md#resource-specific) instead of the existing [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table. In case both sets of logs are required, at least two diagnostic settings need to be created per firewall.
70
-
71
-
In **Resource specific** mode, individual tables in the selected workspace are created for each category selected in the diagnostic setting. This method is recommended since it:
72
-
- makes it much easier to work with the data in log queries
73
-
- makes it easier to discover schemas and their structure
74
-
- improves performance across both ingestion latency and query times
75
-
- allows you to grant Azure RBAC rights on a specific table
76
-
77
-
New resource specific tables are now available in Diagnostic setting that allows you to utilize the following newly added categories:
78
-
79
-
-[Network rule log](/azure/azure-monitor/reference/tables/azfwnetworkrule) - Contains all Network Rule log data. Each match between data plane and network rule creates a log entry with the data plane packet and the matched rule's attributes.
80
-
-[NAT rule log](/azure/azure-monitor/reference/tables/azfwnatrule) - Contains all DNAT (Destination Network Address Translation) events log data. Each match between data plane and DNAT rule creates a log entry with the data plane packet and the matched rule's attributes.
81
-
-[Application rule log](/azure/azure-monitor/reference/tables/azfwapplicationrule) - Contains all Application rule log data. Each match between data plane and Application rule creates a log entry with the data plane packet and the matched rule's attributes.
82
-
-[Threat Intelligence log](/azure/azure-monitor/reference/tables/azfwthreatintel) - Contains all Threat Intelligence events.
83
-
-[IDPS log](/azure/azure-monitor/reference/tables/azfwidpssignature) - Contains all data plane packets that were matched with one or more IDPS signatures.
84
-
-[DNS proxy log](/azure/azure-monitor/reference/tables/azfwdnsquery) - Contains all DNS Proxy events log data.
85
-
-[Internal FQDN resolve failure log](/azure/azure-monitor/reference/tables/azfwinternalfqdnresolutionfailure) - Contains all internal Firewall FQDN resolution requests that resulted in failure.
86
-
-[Application rule aggregation log](/azure/azure-monitor/reference/tables/azfwapplicationruleaggregation) - Contains aggregated Application rule log data for Policy Analytics.
87
-
-[Network rule aggregation log](/azure/azure-monitor/reference/tables/azfwnetworkruleaggregation) - Contains aggregated Network rule log data for Policy Analytics.
88
-
-[NAT rule aggregation log](/azure/azure-monitor/reference/tables/azfwnatruleaggregation) - Contains aggregated NAT rule log data for Policy Analytics.
89
-
90
-
By default, the new resource specific tables are disabled.
91
-
92
-
Run the following Azure PowerShell commands to enable Azure Firewall Structured logs:
93
-
94
-
```azurepowershell
95
-
Connect-AzAccount
96
-
Select-AzSubscription -Subscription "subscription_id or subscription_name"
In addition, when setting up your log analytics workspace, you must select whether you want to work with the AzureDiagnostics table (default) or with Resource Specific Tables.
108
-
109
-
Additional KQL log queries were added to query structured firewall logs.
110
-
111
-
> [!NOTE]
112
-
> Existing Workbooks and any Sentinel integration will be adjusted to support the new structured logs when **Resource Specific** mode is selected.
113
-
114
-
For more information, see [Exploring the New Resource Specific Structured Logging in Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/exploring-the-new-resource-specific-structured-logging-in-azure/ba-p/3620530).
69
+
For more information, see [Azure Structured Firewall Logs (preview)](firewall-structured-logs.md).
115
70
116
71
### Policy Analytics (preview)
117
72
@@ -125,7 +80,7 @@ You can now refine and update Firewall rules and policies with confidence in jus
125
80
126
81
#### Pricing
127
82
128
-
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no additional cost.
83
+
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no added cost.
129
84
130
85
#### Key Policy Analytics features
131
86
@@ -177,11 +132,11 @@ Policy analytics starts monitoring the flows in the DNAT, Network, and Applicati
177
132
178
133
### Single click upgrade/downgrade (preview)
179
134
180
-
You can now easily upgrade your existing Firewall Standard SKU to Premium SKU as well as downgrade from Premium to Standard SKU. The process is fully automated and has no service impact (zero service downtime).
135
+
You can now easily upgrade your existing Firewall Standard SKU to Premium SKU and downgrade from Premium to Standard SKU. The process is fully automated and has no service impact (zero service downtime).
181
136
182
137
In the upgrade process, you can select the policy to be attached to the upgraded Premium SKU. You can select an existing Premium Policy or an existing Standard Policy. You can use your existing Standard policy and let the system automatically duplicate, upgrade to Premium Policy, and then attach it to the newly created Premium Firewall.
183
138
184
-
This new capability is available through the Azure portal as shown here, as well as via PowerShell and Terraform simply by changing the sku_tier attribute.
139
+
This new capability is available through the Azure portal as shown here, and via PowerShell and Terraform simply by changing the sku_tier attribute.
description: Learn about Azure Structured Firewall Logs (preview)
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: conceptual
8
+
ms.date: 01/25/2023
9
+
ms.author: victorh
10
+
---
11
+
12
+
# Azure Structured Firewall Logs (preview)
13
+
14
+
15
+
> [!IMPORTANT]
16
+
> This feature is currently in PREVIEW.
17
+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
19
+
Currently, the following diagnostic log categories are available for Azure Firewall:
20
+
- Application rule log
21
+
- Network rule log
22
+
- DNS proxy log
23
+
24
+
These log categories use [Azure diagnostics mode](../azure-monitor/essentials/resource-logs.md#azure-diagnostics-mode). In this mode, all data from any diagnostic setting will be collected in the [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table.
25
+
26
+
With this new feature, you'll be able to choose to use [Resource Specific Tables](../azure-monitor/essentials/resource-logs.md#resource-specific) instead of the existing [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table. In case both sets of logs are required, at least two diagnostic settings need to be created per firewall.
27
+
28
+
## Resource specific mode
29
+
30
+
In **Resource specific** mode, individual tables in the selected workspace are created for each category selected in the diagnostic setting. This method is recommended since it:
31
+
- makes it much easier to work with the data in log queries
32
+
- makes it easier to discover schemas and their structure
33
+
- improves performance across both ingestion latency and query times
34
+
- allows you to grant Azure RBAC rights on a specific table
35
+
36
+
New resource specific tables are now available in Diagnostic setting that allows you to utilize the following newly added categories:
37
+
38
+
-[Network rule log](/azure/azure-monitor/reference/tables/azfwnetworkrule) - Contains all Network Rule log data. Each match between data plane and network rule creates a log entry with the data plane packet and the matched rule's attributes.
39
+
-[NAT rule log](/azure/azure-monitor/reference/tables/azfwnatrule) - Contains all DNAT (Destination Network Address Translation) events log data. Each match between data plane and DNAT rule creates a log entry with the data plane packet and the matched rule's attributes.
40
+
-[Application rule log](/azure/azure-monitor/reference/tables/azfwapplicationrule) - Contains all Application rule log data. Each match between data plane and Application rule creates a log entry with the data plane packet and the matched rule's attributes.
41
+
-[Threat Intelligence log](/azure/azure-monitor/reference/tables/azfwthreatintel) - Contains all Threat Intelligence events.
42
+
-[IDPS log](/azure/azure-monitor/reference/tables/azfwidpssignature) - Contains all data plane packets that were matched with one or more IDPS signatures.
43
+
-[DNS proxy log](/azure/azure-monitor/reference/tables/azfwdnsquery) - Contains all DNS Proxy events log data.
44
+
-[Internal FQDN resolve failure log](/azure/azure-monitor/reference/tables/azfwinternalfqdnresolutionfailure) - Contains all internal Firewall FQDN resolution requests that resulted in failure.
45
+
-[Application rule aggregation log](/azure/azure-monitor/reference/tables/azfwapplicationruleaggregation) - Contains aggregated Application rule log data for Policy Analytics.
46
+
-[Network rule aggregation log](/azure/azure-monitor/reference/tables/azfwnetworkruleaggregation) - Contains aggregated Network rule log data for Policy Analytics.
47
+
-[NAT rule aggregation log](/azure/azure-monitor/reference/tables/azfwnatruleaggregation) - Contains aggregated NAT rule log data for Policy Analytics.
48
+
49
+
## Enable/disable structured logs
50
+
51
+
By default, the new resource specific tables are disabled.
52
+
53
+
Run the following Azure PowerShell commands to enable Azure Firewall Structured logs:
54
+
55
+
```azurepowershell
56
+
Connect-AzAccount
57
+
Select-AzSubscription -Subscription "subscription_id or subscription_name"
In addition, when setting up your log analytics workspace, you must select whether you want to work with the AzureDiagnostics table (default) or with Resource Specific Tables.
69
+
70
+
Additional KQL log queries were added to query structured firewall logs.
71
+
72
+
> [!NOTE]
73
+
> Existing Workbooks and any Sentinel integration will be adjusted to support the new structured logs when **Resource Specific** mode is selected.
74
+
75
+
## Next steps
76
+
77
+
- For more information, see [Exploring the New Resource Specific Structured Logging in Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/exploring-the-new-resource-specific-structured-logging-in-azure/ba-p/3620530).
78
+
79
+
80
+
- To learn more about Azure Firewall logs and metrics, see [Azure Firewall logs and metrics](logs-and-metrics.md)
0 commit comments