You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/firewall/firewall-preview.md
+3-59Lines changed: 3 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,7 +35,7 @@ With this new feature, the event logs for network rules adds the following attri
35
35
- Rule collection
36
36
- Rule name
37
37
38
-
For more information, see [Azure network rule name logging (preview)](firewall-network-rule-logging.md).
38
+
For more information, see [Azure Firewall network rule name logging (preview)](firewall-network-rule-logging.md).
39
39
40
40
### Structured Firewall Logs (preview)
41
41
@@ -50,65 +50,9 @@ For more information, see [Azure Structured Firewall Logs (preview)](firewall-st
50
50
51
51
### Policy Analytics (preview)
52
52
53
-
Policy Analytics provides insights, centralized visibility, and control to Azure Firewall. IT teams today are challenged to keep Firewall rules up to date, manage existing rules, and remove unused rules. Any accidental rule updates can lead to a significant downtime for IT teams.
53
+
Policy Analytics provides insights, centralized visibility, and control to Azure Firewall. IT teams today are challenged to keep Firewall rules up to date, manage existing rules, and remove unused rules. Any accidental rule updates can lead to a significant downtime for IT teams.
54
54
55
-
For large, geographically dispersed organizations, manually managing Firewall rules and policies is a complex and sometimes error-prone process. The new Policy Analytics feature is the answer to this common challenge faced by IT teams.
56
-
57
-
You can now refine and update Firewall rules and policies with confidence in just a few steps in the Azure portal. You have granular control to define your own custom rules for an enhanced security and compliance posture. You can automate rule and policy management to reduce the risks associated with a manual process.<br><br>
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no added cost.
64
-
65
-
#### Key Policy Analytics features
66
-
67
-
-**Policy insight panel**: Aggregates insights and highlights relevant policy information.
68
-
-**Rule analytics**: Analyzes existing DNAT, Network, and Application rules to identify rules with low utilization or rules with low usage in a specific time window.
69
-
-**Traffic flow analysis**: Maps traffic flow to rules by identifying top traffic flows and enabling an integrated experience.
70
-
-**Single Rule analysis**: Analyzes a single rule to learn what traffic hits that rule to refine the access it provides and improve the overall security posture.
71
-
72
-
### Prerequisites
73
-
74
-
- An Azure Firewall Standard or Premium
75
-
- An Azure Firewall Standard or Premium policy attached to the Firewall
76
-
- The [network rule name logging preview feature](#network-rule-name-logging-preview) must be enabled to view network rules analysis
77
-
- The [structured firewall logs feature](#structured-firewall-logs-preview) must be enabled on Firewall Standard or Premium
78
-
79
-
80
-
### Enable Policy Analytics
81
-
82
-
Policy analytics starts monitoring the flows in the DNAT, Network, and Application rule analysis only after you enable the feature. It can't analyze rules hit before the feature is enabled.
83
-
84
-
#### Firewall with no Diagnostics settings configured
85
-
86
-
87
-
1. Once all prerequisites are met, select **Policy analytics (preview)** in the table of contents.
88
-
2. Next, select **Configure Workspaces**.
89
-
3. In the pane that opens, select the **Enable Policy Analytics** checkbox.
90
-
4. Next, choose a log analytics workspace. The log analytics workspace should be the same as the Firewall attached to the policy.
91
-
5. Select **Save** after you choose the log analytics workspace.
92
-
6. Go to the Firewall attached to the policy and enter the **Diagnostic settings** page. You'll see the **FirewallPolicySetting** added there as part of the policy analytics feature.
93
-
7. Select **Edit Setting**, and ensure the **Resource specific** toggle is checked, and the highlighted tables are checked. In the previous example, all logs are written to the log analytics workspace.
94
-
95
-
#### Firewall with Diagnostics settings already configured
96
-
97
-
1. Ensure that the Firewall attached to the policy is logging to **Resource Specific** tables, and that the following three tables are also selected:
98
-
- AZFWApplicationRuleAggregation
99
-
- AZFWNetworkRuleAggregation
100
-
- AZFWNatRuleAggregation
101
-
2. Next, select **Policy Analytics (preview)** in the table of contents. Once inside the feature, select **Configure Workspaces**.
102
-
3. Now, select **Enable Policy Analytics**.
103
-
4. Next, choose a log analytics workspace. The log analytics workspace should be the same as the Firewall attached to the policy.
104
-
5. Select **Save** after you choose the log analytics workspace.
105
-
106
-
During the save process, you might see the following error message: **Failed to update Diagnostic Settings**
107
-
108
-
You can disregard this error message if the policy was successfully updated.
109
-
110
-
> [!TIP]
111
-
> Policy Analytics has a dependency on both Log Analytics and Azure Firewall resource specific logging. Verify the Firewall is configured appropriately or follow the previous instructions. Be aware that logs take 60 minutes to appear after enabling them for the first time. This is because logs are aggregated in the backend every hour. You can check logs are configured appropriately by running a log analytics query on the resource specific tables such as **AZFWNetworkRuleAggregation**, **AZFWApplicationRuleAggregation**, and **AZFWNatRuleAggregation**.
55
+
For more information, see [Azure Firewall Policy Analytics (preview)](policy-analytics.md).
description: Learn about Azure Firewall Policy Analytics (preview)
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: conceptual
8
+
ms.date: 01/26/2023
9
+
ms.author: victorh
10
+
---
11
+
12
+
# Azure Firewall Policy Analytics (preview)
13
+
14
+
15
+
> [!IMPORTANT]
16
+
> This feature is currently in PREVIEW.
17
+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
19
+
Policy Analytics provides insights, centralized visibility, and control to Azure Firewall. IT teams today are challenged to keep Firewall rules up to date, manage existing rules, and remove unused rules. Any accidental rule updates can lead to a significant downtime for IT teams.
20
+
21
+
For large, geographically dispersed organizations, manually managing Firewall rules and policies is a complex and sometimes error-prone process. The new Policy Analytics feature is the answer to this common challenge faced by IT teams.
22
+
23
+
You can now refine and update Firewall rules and policies with confidence in just a few steps in the Azure portal. You have granular control to define your own custom rules for an enhanced security and compliance posture. You can automate rule and policy management to reduce the risks associated with a manual process.<br><br>
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no added cost.
30
+
31
+
## Key Policy Analytics features
32
+
33
+
-**Policy insight panel**: Aggregates insights and highlights relevant policy information.
34
+
-**Rule analytics**: Analyzes existing DNAT, Network, and Application rules to identify rules with low utilization or rules with low usage in a specific time window.
35
+
-**Traffic flow analysis**: Maps traffic flow to rules by identifying top traffic flows and enabling an integrated experience.
36
+
-**Single Rule analysis**: Analyzes a single rule to learn what traffic hits that rule to refine the access it provides and improve the overall security posture.
37
+
38
+
## Prerequisites
39
+
40
+
- An Azure Firewall Standard or Premium
41
+
- An Azure Firewall Standard or Premium policy attached to the Firewall
42
+
- The [Azure Firewall network rule name logging (preview)](firewall-network-rule-logging.md) must be enabled to view network rules analysis.
43
+
- The [Azure Structured Firewall Logs (preview)](firewall-structured-logs.md) must be enabled on Firewall Standard or Premium.
44
+
45
+
46
+
## Enable Policy Analytics
47
+
48
+
Policy analytics starts monitoring the flows in the DNAT, Network, and Application rule analysis only after you enable the feature. It can't analyze rules hit before the feature is enabled.
49
+
50
+
### Firewall with no diagnostics settings configured
51
+
52
+
53
+
1. Once all prerequisites are met, select **Policy analytics (preview)** in the table of contents.
54
+
2. Next, select **Configure Workspaces**.
55
+
3. In the pane that opens, select the **Enable Policy Analytics** checkbox.
56
+
4. Next, choose a log analytics workspace. The log analytics workspace should be the same as the Firewall attached to the policy.
57
+
5. Select **Save** after you choose the log analytics workspace.
58
+
6. Go to the Firewall attached to the policy and enter the **Diagnostic settings** page. You'll see the **FirewallPolicySetting** added there as part of the policy analytics feature.
59
+
7. Select **Edit Setting**, and ensure the **Resource specific** toggle is checked, and the highlighted tables are checked. In the previous example, all logs are written to the log analytics workspace.
60
+
61
+
### Firewall with Diagnostics settings already configured
62
+
63
+
1. Ensure that the Firewall attached to the policy is logging to **Resource Specific** tables, and that the following three tables are also selected:
64
+
- AZFWApplicationRuleAggregation
65
+
- AZFWNetworkRuleAggregation
66
+
- AZFWNatRuleAggregation
67
+
2. Next, select **Policy Analytics (preview)** in the table of contents. Once inside the feature, select **Configure Workspaces**.
68
+
3. Now, select **Enable Policy Analytics**.
69
+
4. Next, choose a log analytics workspace. The log analytics workspace should be the same as the Firewall attached to the policy.
70
+
5. Select **Save** after you choose the log analytics workspace.
71
+
72
+
During the save process, you might see the following error message: **Failed to update Diagnostic Settings**
73
+
74
+
You can disregard this error message if the policy was successfully updated.
75
+
76
+
> [!TIP]
77
+
> Policy Analytics has a dependency on both Log Analytics and Azure Firewall resource specific logging. Verify the Firewall is configured appropriately or follow the previous instructions. Be aware that logs take 60 minutes to appear after enabling them for the first time. This is because logs are aggregated in the backend every hour. You can check logs are configured appropriately by running a log analytics query on the resource specific tables such as **AZFWNetworkRuleAggregation**, **AZFWApplicationRuleAggregation**, and **AZFWNatRuleAggregation**.
78
+
79
+
## Next steps
80
+
81
+
82
+
- To learn more about Azure Firewall logs and metrics, see [Azure Firewall logs and metrics](logs-and-metrics.md).
0 commit comments