Skip to content

Commit 11311e8

Browse files
kshitiz-progashwinikarkeKshitiz SharmaCopilotKshitiz sharma
authored
Network-25537 : Threat intelligence is Enabled in Deny Mode on Azure Firewall (#780)
* added test files for 25537 * updated code * updated code * feature-25537 * Code Fix * Update src/powershell/tests/Test-Assessment.25537.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Code fix as per alex feedback * Code update as per spec * Feature-25533 - Co-pilot fix * Reviewer comment resolved * Remove black space in status messages in Test-Assessment-25537 --------- Co-authored-by: Ashwini Karke <ashwini.karke@perennialsys.com> Co-authored-by: Kshitiz Sharma <kshitiz.p@pereniialsys.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Kshitiz sharma <kshiti.p@perennialsys.com> Co-authored-by: alexandair <alexandair@live.com>
1 parent 88f06e9 commit 11311e8

2 files changed

Lines changed: 174 additions & 0 deletions

File tree

‎src/powershell/tests/Test-Assessment.25537.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Azure Firewall Threat intelligence-based filtering alerts and denies traffic from/to known malicious IP addresses, FQDNs, and URLs. The IP addresses, domains, and URLs are sourced from the Microsoft Threat Intelligence feed, which includes multiple sources including the Microsoft Cyber Security team. When threat intelligence-based filtering is enabled, Azure Firewall evaluates traffic against the threat intelligence rules before applying NAT, network, or application rules.
2+
3+
This check verifies that Threat Intelligence feature is enabled in “Alert and Deny” mode in the Azure Firewall policy configuration. The check will fail if Threat Intelligence is either “Disabled” or if it is not configured in “Alert and Deny” mode, in the firewall policy attached to the firewall.
4+
5+
**Remediation action**
6+
7+
Please check this article for guidance on how to enable Threat Intelligence in “Alert and Deny” mode in the Azure Firewall Policy:
8+
- [Azure Firewall threat intelligence configuration | Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall-manager/threat-intelligence-settings)
9+
10+
<!--- Results --->
11+
%TestResult%

‎src/powershell/tests/Test-Assessment.25537.ps1‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
2+
<#
3+
.SYNOPSIS
4+
Validates Threat intelligence is Enabled in Deny Mode on Azure Firewall.
5+
.DESCRIPTION
6+
This test validates that Azure Firewall Policies have Threat Intelligence enabled in Deny mode.
7+
Checks all firewall policies in the subscription and reports their threat intelligence status.
8+
.NOTES
9+
Test ID: 25537
10+
Category: Azure Network Security
11+
Required API: Azure Firewall Policies
12+
#>
13+
14+
function Test-Assessment-25537 {
15+
[ZtTest(
16+
Category = 'Azure Network Security',
17+
ImplementationCost = 'Low',
18+
MinimumLicense = ('Azure_Firewall_Standard', 'Azure_Firewall_Premium'),
19+
Pillar = 'Network',
20+
RiskLevel = 'High',
21+
SfiPillar = 'Protect networks',
22+
TenantType = ('Workforce'),
23+
TestId = 25537,
24+
Title = 'Threat intelligence is Enabled in Deny Mode on Azure Firewall',
25+
UserImpact = 'Low'
26+
)]
27+
[CmdletBinding()]
28+
param()
29+
30+
Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
31+
32+
#region Data Collection
33+
$activity = 'Azure Firewall Threat Intelligence'
34+
Write-ZtProgress -Activity $activity -Status 'Enumerating Firewall Policies'
35+
36+
# Query 1: List all subscriptions
37+
$context = Get-AzContext
38+
if (($context).Environment.name -ne 'AzureCloud') {
39+
Write-PSFMessage "This test is only applicable to the Global environment." -Tag Test -Level VeryVerbose
40+
Add-ZtTestResultDetail -SkippedBecause NotSupported
41+
return
42+
}
43+
44+
try {
45+
$accessToken = Get-AzAccessToken -AsSecureString -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
46+
}
47+
catch {
48+
Write-PSFMessage $_.Exception.Message -Tag Test -Level Error
49+
}
50+
51+
if (-not $accessToken) {
52+
Write-PSFMessage "Azure authentication token not found." -Tag Test -Level Warning
53+
Add-ZtTestResultDetail -SkippedBecause 'NotConnectedAzure'
54+
return
55+
}
56+
$resourceManagerUrl = ($context).Environment.ResourceManagerUrl.TrimEnd('/')
57+
$subscriptionsUri = "$resourceManagerUrl/subscriptions?api-version=2025-03-01"
58+
59+
try {
60+
$subscriptionsResponse = Invoke-AzRestMethod -Method GET -Uri $subscriptionsUri -ErrorAction Stop
61+
}
62+
catch {
63+
if ($_.Exception.Response.StatusCode -eq 403 -or $_.Exception.Message -like '*403*' -or $_.Exception.Message -like '*Forbidden*') {
64+
Add-ZtTestResultDetail -SkippedBecause NoAzureAccess
65+
return
66+
}
67+
}
68+
69+
$subscriptions = ($subscriptionsResponse.Content | ConvertFrom-Json).value
70+
71+
if (-not $subscriptions) {
72+
Add-ZtTestResultDetail -SkippedBecause NoAzureAccess
73+
return
74+
}
75+
$results = @()
76+
foreach ($sub in $subscriptions) {
77+
78+
Set-AzContext -SubscriptionId $sub.subscriptionId | Out-Null
79+
80+
# Query 2 : List Azure Firewall Policies
81+
try {
82+
$policiesUri = "$resourceManagerUrl/subscriptions/$($sub.subscriptionId)/providers/Microsoft.Network/firewallPolicies?api-version=2025-03-01"
83+
Write-ZtProgress -Activity $activity -Status "Enumerating policies in subscription $($sub.displayName)"
84+
85+
$policyResponse = (Invoke-AzRestMethod -Method GET -Uri $policiesUri -ErrorAction Stop ).Content | ConvertFrom-Json
86+
$policies = $policyResponse.value
87+
88+
}
89+
catch {
90+
Write-PSFMessage "Unable to enumerate firewall policies in subscription $($sub.displayName): $($_.Exception.Message)" -Tag Firewall -Level Warning
91+
continue
92+
}
93+
94+
if (-not $policies) {
95+
continue
96+
}
97+
98+
# Query 2: Get details for each firewall policy and check threatIntelMode
99+
foreach ($policyResource in $policies) {
100+
101+
$threatIntelMode = $policyResource.Properties.threatIntelMode
102+
103+
$subContext = Get-AzContext
104+
105+
$results += [PSCustomObject]@{
106+
PolicyName = $policyResource.Name
107+
SubscriptionName = $subContext.Subscription.Name
108+
SubscriptionId = $subContext.Subscription.Id
109+
ThreatIntelMode = $threatIntelMode
110+
PolicyID = $policyResource.Id
111+
Passed = $threatIntelMode -eq 'Deny'
112+
}
113+
}
114+
}
115+
#endregion Data Collection
116+
117+
#region Assessment Logic
118+
119+
120+
$passed = ($results | Where-Object { -not $_.Passed }).Count -eq 0
121+
$allAlert = ($results | Where-Object { $_.ThreatIntelMode -ne 'Alert' }).Count -eq 0
122+
123+
$testResultMarkdown = if ($passed) {
124+
"Threat Intel is enabled in **Alert and Deny** mode.`n`n%TestResult%"
125+
}
126+
elseif ($allAlert) {
127+
"Threat Intel is enabled in **Alert** mode.`n`n%TestResult%"
128+
}
129+
else {
130+
"Threat Intel is not enabled in **Alert and Deny** mode for all Firewall policies.`n`n%TestResult%"
131+
}
132+
#endregion Assessment Logic
133+
134+
#region Report Generation
135+
$mdInfo = "## Firewall policies`n`n"
136+
$mdInfo += "| Policy name | Subscription name | Threat Intel mode | Result |`n"
137+
$mdInfo += "| :--- | :--- | :--- | :--- |`n"
138+
139+
foreach ($item in $results | Sort-Object PolicyName) {
140+
$policyLink = "https://portal.azure.com/#resource$($item.PolicyID)"
141+
$subLink = "https://portal.azure.com/#resource/subscriptions/$($item.SubscriptionId)"
142+
$policyMd = "[$(Get-SafeMarkdown -Text $item.PolicyName)]($policyLink)"
143+
$subMd = "[$(Get-SafeMarkdown -Text $item.SubscriptionName)]($subLink)"
144+
$icon = if ($item.Passed) {
145+
'✅'
146+
}
147+
else {
148+
'❌'
149+
}
150+
$mdInfo += "| $policyMd | $subMd | $($item.ThreatIntelMode) | $icon |`n"
151+
}
152+
153+
$testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
154+
#endregion Report Generation
155+
$params = @{
156+
TestId = '25537'
157+
Title = 'Threat intelligence is Enabled in Deny Mode on Azure Firewall'
158+
Status = $passed
159+
Result = $testResultMarkdown
160+
}
161+
162+
Add-ZtTestResultDetail @params
163+
}

0 commit comments

Comments
 (0)