> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/cloud-log-forwarding/azure-microsoft/azure-firewall.md).

# Azure Firewall

Azure Firewall Log Forwarding Guide

**Step 1 - Creating Resource Group**

A resource group is a logical collection of Azure resources. All resources are deployed and managed in a resource group. To create a resource group:

1. Login to the Azure portal: <https://portal.azure.com/>
2. Click **Resource groups** in the left navigation pane and Click **Create** on **Resource groups** page.

![A screenshot of a computer AI-generated content may be incorrect.](/files/4f16b6fb169186804615bed7629018263a37bdb2)

3. For **Subscription,** select the name of the Azure subscription in which you want to create the resource group.
4. Enter a unique name for the resource group, The system immediately checks to see if the name is available in the currently selected Azure subscription.
5. Select a **Region** for the resource group. Click **Review + Create**. Click **Create** again on next page.

![A screenshot of a group AI-generated content may be incorrect.](/files/e20b08a43813c4c897435909316c2f3dc49514b2)

**Step 2 - Creating Event Hub Namespace**

An Event Hub namespace provides a unique scoping container, referenced by its fully qualified domain name, in which you create one or more event hubs. To create a namespace in your resource group using the portal, complete the following steps:

1. In the Azure portal, click Create a resource at the top left of the screen.

![A screenshot of a computer AI-generated content may be incorrect.](/files/6320d59bdb57522b8c10a479e48a6372ab0c365b)

2. Search for Event Hubs, and then click the Create button in the Event Hubs page.

![A screenshot of a computer AI-generated content may be incorrect.](/files/c9bf9ebb4456ba6fc9740459df42d3f3d76aedf8)

3. On the Create namespace page, complete the following steps:

3.1 Select the **subscription** in which you want to create the namespace.

3.2 Select the **Resource group** for the namespace.

3.3 Enter a name for the **namespace**. The system immediately checks to see if the name is available.

3.4 Select a location for the namespace and choose the pricing tier **“Standard"**– required for additional, custom consumer groups other than **$Default** group.

3.5 Click **Review + Create** and then **Create**. This will take few minutes for the system to fully provision the resources.

![](/files/cfab1ec4a9c73c2573080bb97828ed6c96d23f5e)

3.6 Refresh the Event Hubs page to see the event hub namespace. You can check the status of the event hub creation in the alerts. Select the namespace. You see the home page for your Event Hubs Namespace in the portal.

![A screenshot of a computer AI-generated content may be incorrect.](/files/0223c8f4fae8dc9b1bf4d062665e90ebca53321d)

**Step 3 - Creating an Event Hub**

To Create an Event Hub within the namespace, follow these steps:

1. In the Event Hubs Namespace page, click Event Hubs in the left menu.

![A screenshot of a computer AI-generated content may be incorrect.](/files/836f2d189feb9a55bc12862c1c820ca2f393da30)

2. At the top of the window, click + Event Hub.

![A screenshot of a computer AI-generated content may be incorrect.](/files/b6d5c84d5754cf3b91d575c6e97a4d60d568f68a)

3. Choose an appropriate name for your event hub, then click Create

![A screenshot of a computer AI-generated content may be incorrect.](/files/362709afca6d4098f8abd7d14779432091a74a7e)

4. After the event hub is created, you see it in the list of event hubs.

\*\*Note:\*\*This step is not required for all types of logs. Some log sources automatically create their own event hub like **insights-logs-auditlogs, insights-logs-signinlogs, insights-activity- logs**, others, within the namespace you created above. We recommend creating an Event Hub for sake of clarity.

**Step 4 - Configure an Event Hub Namespace**

To Generate Shared Access Policy for Event Hub Namespace you’ve created

1. Select event hub namespace and go to **Shared access policies,** and then click **+Add**. Enter the Policy name, check the **Manage** box, and then click **Create**.

![A screenshot of a computer AI-generated content may be incorrect.](/files/672911a8084b1d08fa7f4fe76632177ab054930b)

2. Click on the **Shared Access policies**you just created, make a note of the **connection string primary key field** for later use.

![A screenshot of a computer AI-generated content may be incorrect.](/files/64ac92d3bd5e90a9361525b07ba9db13cab34bf6)

3. BluSapphire collector requires the SAS Policy name (created in Step 4 - 1) and the **connection string primary key** when creating the credential in “blusapphire-sas". Copy the **connection string primary key** and **policy name** to a text editor for later use.

\*\*Note:\*\*When the event hub namespace is created, Azure will also create a default Shared Access Policy named **RootManageSharedAcessKey.**

4. Select an event hub namespace and go to respective Event Hub.
5. From the selected event hub, go to Consumer group within that event hub. Click **+Consumer** group to create a new consumer group.

![A screenshot of a computer AI-generated content may be incorrect.](/files/86bf7bc17f1e8bbd086e27a9468ac854dbea8945)

![A screenshot of a login form AI-generated content may be incorrect.](/files/4f63a455eae7b7e6579fd4d8f1b8718749180b34)

\*\*Note:\*\*Please ensure you select Standard tier while creating Event Hub Namespace, this allows creating multiple Consumer Groups.

**Step 5 - Enable Azure Firewall Logs to Event Hub**

In Azure Portal:

1. Navigate to your Azure Firewall
2. Click **Diagnostic Settings**
3. Click **+ Add diagnostic setting**
4. Under **Logs – Categories** select all the logs
5. Under **Destination details** select:\*\* Send to Event Hub\*\*
6. Choose:
7. Event Hub Namespace that you have created
8. Event Hub name that you have created
9. Save

**After the above steps are completed, please share the below details.**

| **Required Details**  | **Azure Location**               |
| --------------------- | -------------------------------- |
| eventhub              | Event Hub → Name                 |
| consumer\_group       | Event Hub → Consumer Groups      |
| connection\_string    | Event Hub → Shared Access Policy |
| storage\_account      | Storage Account → Overview       |
| storage\_account\_key | Storage Account → Access Keys    |