You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/firewall/firewall-copilot.md
+12-10Lines changed: 12 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Azure Firewall integration in Microsoft Security Copilot (preview)
3
-
description: Learn about using Microsoft Security Copilot to investigate traffic flagged by Azure Firewall with IDPS and threat intelligence.
3
+
description: Learn about using Microsoft Security Copilot to investigate traffic flagged by Azure Firewall with Intrusion Detection and Prevention System (IDPS) and threat intelligence.
4
4
keywords: security copilot, copilot for security, threat intelligence, IDPS, intrusion detection and prevention system, plugin, integration, azure firewall, firewall copilot, open ai, openai, co-pilot
5
5
author: abhinavsriram
6
6
ms.author: asriram
@@ -33,7 +33,7 @@ If you're new to Security Copilot, you should familiarize yourself with it by re
33
33
34
34
Azure Firewall is a cloud-native and intelligent network firewall security service that provides best of breed threat protection for your cloud workloads running in Azure. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
35
35
36
-
The Azure Firewall integration in Security Copilot enables analysts to conduct thorough investigations of malicious traffic intercepted by the IDPS feature across their entire fleet using natural language queries.
36
+
The integration of Azure Firewall with Security Copilot enables analysts to comprehensively investigate malicious traffic intercepted by the IDPS feature across their entire fleet using natural language queries.
37
37
38
38
You can use this integration in the [Security Copilot portal](https://securitycopilot.microsoft.com) or the [Copilot in Azure](/azure/copilot/overview) experience in the Azure portal:
39
39
@@ -61,13 +61,15 @@ To view the list of built-in system capabilities for Azure Firewall, use the fol
61
61
62
62
-[Azure Firewall Structured Logs](firewall-structured-logs.md#resource-specific-mode) – the Azure Firewalls to be used with Security Copilot must be configured with resource specific structured logs for IDPS and these logs must be sent to a Log Analytics workspace.
63
63
64
-
-[Role Based Access Control for Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/role-based-access-control-for-azure-firewall/ba-p/2245598) – the users using the Azure Firewall plugin in Security Copilot must have the appropriate Azure RBAC roles to access the Firewall and associated Log Analytics workspaces.
64
+
-[Role Based Access Control for Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/role-based-access-control-for-azure-firewall/ba-p/2245598) – the users using the Azure Firewall plugin in Security Copilot must have the appropriate Azure Role-based access control roles to access the Firewall and associated Log Analytics workspaces.
65
65
66
66
1. Go to [Security Copilot](https://go.microsoft.com/fwlink/?linkid=2247989) and sign in with your credentials.
67
67
68
68
1. Ensure that the Azure Firewall plugin is turned on. In the prompt bar, select the **Sources** icon.
69
69
70
-
1. In the **Manage sources** pop-up window that appears, confirm that the **Azure Firewall** toggle is turned on, then close the window. No other configuration is necessary, as long as structured logs are being sent to a Log Analytics workspace and you have the right RBAC permissions, Copilot finds the data it needs to answer your questions.
70
+
1. In the **Manage sources** pop-up window that appears, confirm that the **Azure Firewall** toggle is turned on. Then, close the window.
71
+
72
+
No other configuration is necessary. As long as structured logs are being sent to a Log Analytics workspace and you have the right RBAC permissions, Copilot finds the data it needs to answer your questions.
71
73
72
74
:::image type="content" source="media/firewall-copilot/azure-firewall-plugin.png" alt-text="Screenshot showing the Azure Firewall plugin.":::
73
75
@@ -128,13 +130,13 @@ Get **information from documentation** about using Azure Firewall's IDPS feature
128
130
**Sample prompts**:
129
131
130
132
- How do I protect myself from future attacks from this attacker across my entire infrastructure?
131
-
- If I want to make sure all my Firewalls are protected against attacks from signature ID _\<ID number\>_, how do I do this?
133
+
- If I want to make sure all my Azure Firewalls are protected against attacks from signature ID _\<ID number\>_, how do I accomplish this?
132
134
- What is the difference in risk between alert only and alert and block modes for IDPS?
133
135
134
-
:::image type="content" source="media/firewall-copilot/copilot-capability-4-embedded.png" alt-text="Screenshot showing the generate recommendations to secure your environment using Azure Firewall's IDPS feature capability." lightbox="media/firewall-copilot/copilot-capability-4-embedded.png":::
136
+
:::image type="content" source="media/firewall-copilot/copilot-capability-4-embedded.png" alt-text="Screenshot showing the generated recommendations to secure your environment using Azure Firewall's IDPS feature capability." lightbox="media/firewall-copilot/copilot-capability-4-embedded.png":::
135
137
136
138
> [!NOTE]
137
-
> Security Copilot may also use the *Ask Microsoft Documentation* capability to provide this information and when using this capability via the Copilot in Azure experience, the *Get Information* capability may be used to provide this information.
139
+
> Security Copilot may also use the _Ask Microsoft Documentation_ capability to provide this information and when using this capability via the Copilot in Azure experience, the _Get Information_ capability may be used to provide this information.
138
140
139
141
## Provide feedback
140
142
@@ -148,15 +150,15 @@ Select **How’s this response?** at the bottom of each completed prompt and cho
148
150
-**Needs improvement** - Select if any detail in the results is incorrect or incomplete, based on your assessment.
149
151
-**Inappropriate** - Select if the results contain questionable, ambiguous, or potentially harmful information.
150
152
151
-
For each feedback option, you can provide additional information in the subsequent dialog box. Whenever possible, and especially when the result is **Needs improvement**, please write a few words explaining how the outcome can be improved. If you entered prompts specific to Azure Firewall and the results are not related, please include that information.
153
+
For each feedback option, you can provide additional information in the subsequent dialog box. Whenever possible, and especially when the result is **Needs improvement**, write a few words explaining how the outcome can be improved. If you entered prompts specific to Azure Firewall and the results aren't related, include that information.
152
154
153
155
### Through Copilot in Azure
154
156
155
-
Use the **like** and **dislike** buttons at the bottom of each completed prompt. For either feedback option, you can provide additional information in the subsequent dialog box. Whenever possible, and especially when you dislike a response, write a few words explaining how the outcome can be improved. If you entered prompts specific to Azure Firewall and the results are not related, please include that information.
157
+
Use the **like** and **dislike** buttons at the bottom of each completed prompt. For either feedback option, you can provide additional information in the subsequent dialog box. Whenever possible, and especially when you dislike a response, write a few words explaining how the outcome can be improved. If you entered prompts specific to Azure Firewall and the results aren't related, include that information.
156
158
157
159
## Privacy and data security in Security Copilot
158
160
159
-
When you interact with Security Copilot (via the Security Copilot portal or via the Copilot in Azure experience) to get Azure Firewall data, Copilot pulls that data from Azure Firewall. The prompts, the data retrieved, and the output shown in the prompt results are processed and stored within the Copilot service. For more information, see [Privacy and data security in Microsoft Security Copilot](/copilot/security/privacy-data-security).
161
+
When you interact with Security Copilot to get Azure Firewall data, Copilot pulls that data from Azure Firewall. The prompts, the data retrieved, and the output shown in the prompt results are processed and stored within the Copilot service. For more information, see [Privacy and data security in Microsoft Security Copilot](/copilot/security/privacy-data-security).
0 commit comments