Unable to retrieve azure firewall log from portal

@Ananya Sarkar
The “brute force credential” is what is generated from Microsoft’s Threat Intel feed. Typically, a few scenarios where you may get this in logs:

1. If you enabled DNAT to one of the VMs behind the FW, there might be real brute force attacks from one of those Ips.
2. Otherwise, it is possible that you have some malicious app that is trying to get access to one of those Ips.
3. You are accessing something “legit” (or what they believe that is legit) to one of those Ips, and this traffic gets flagged.

We’ve also seen two false positive cases:

1. Threat Intel database contains private Ips that only make sense to internal networks
2. Azure sometimes allows customers to use any IP range including public IP range that the customer does not own as VNET address space. In other words, a customer’s VM can have some IP that looks like a Public IP that may match a real public malicious IP from Threat Intel database.

If you would like, we can get the exact IPs from you, then we can reach out to our Threat Intel team to specifically determine what is happening. Thank you!