Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
600 questions
How to generate inbound/outbound threat intel attack for Azure FW
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 67%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Ananya Sarkar
311
Reputation points
I know if i have NAT rule associated with my Azure FW, it generates some inbound brute force threat intel alerts, but if I want to create threat intel alert from my system deliberately as part of security testing, so it can generate inbound/outbound threat intel alerts for my FW, do you guys have any suggestion how can I do that?
It is important for my tests for threat intel alerts. Plz suggest
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 36%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
SaiKishor-MSFT 17,216 Reputation points2020-12-17T00:32:40.367+00:00 Here is a link that talks about Azure Firewall Inbound/Outbound Threat Intelligence testing.
Outbound testing - Outbound traffic alerts should be a rare occurrence, as it means that your environment has been compromised. To help test outbound alerts are working, a test FQDN has been created that triggers an alert. Use testmaliciousdomain.eastus.cloudapp.azure.com for your outbound tests.
Inbound testing - You can expect to see alerts on incoming traffic if DNAT rules are configured on the firewall. This is true even if only specific sources are allowed on the DNAT rule and traffic is otherwise denied. Azure Firewall doesn't alert on all known port scanners; only on scanners that are known to also engage in malicious activity.
Hope this helps. Please let me know if you need any further assistance and we will be glad to help. Thank you!
-
Ananya Sarkar 311 Reputation points
2020-12-17T06:00:16.073+00:00 I know this information already and could get the inbound/outbound alerts. Thanks again.
But I want to generate inbound threat intel alert by myself for testing (like through sql injection or any other way).
I want to get that information, is there any way, I can trigger the inbound alerts for the VM that is behind a FW, by myself without blacklisting my system ip? -
SaiKishor-MSFT 17,216 Reputation points
2020-12-17T07:47:01.533+00:00 @Ananya Sarkar Thank you for clarifying your question further.
Azure Threat Intelligence alerts/denies traffic from known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Therefore, I am not determined if this is something that you can generate. However, let me reach out to our team internally and see if there are any ways to do the same. Please allow me to get back to you with more details soon. Thank you!
-
Ananya Sarkar 311 Reputation points
2020-12-22T17:07:59.343+00:00 Hi @SaiKishor-MSFT , any update on this?
-
SaiKishor-MSFT 17,216 Reputation points
2020-12-24T00:30:05.553+00:00 Thank you for your patience. I have an update from our team as follows-
Firewall does not terminate TLS for inbound traffic, and has no ability to detect SQL Injection and other web attacks. Azure WAF is the tool for that. An upcoming Azure Firewall Premium SKU will be able to detect malicious traffic using IDPS signatures, but this will be most applicable to east-west and outbound traffic rather than inbound web traffic.
Therefore, at the moment there is no way that you could test inbound threat alerts yourself. If you have any other questions/concerns, please feel free to let us know. Thank you!
-
Ananya Sarkar 311 Reputation points
2020-12-24T05:46:18.617+00:00 Hi @SaiKishor-MSFT , did you get any update on this? This is important, i need to generate sql injection or any kind of threat to generate the inbound alerts.
-
SaiKishor-MSFT 17,216 Reputation points
2020-12-30T20:00:55.697+00:00 Firewall does not terminate TLS for inbound traffic, and has no ability to detect SQL Injection and other web attacks. Azure WAF is the tool for that. An upcoming Azure Firewall Premium SKU will be able to detect malicious traffic using IDPS signatures, but this will be most applicable to east-west and outbound traffic rather than inbound web traffic.
Therefore, at the moment there is no way that you could test inbound threat alerts yourself. If you have any other questions/concerns, please feel free to let us know. Thank you!
Sign in to comment