Azure Firewall

Azure Firewall Log Forwarding Guide

Step 1 - Creating Resource Group

A resource group is a logical collection of Azure resources. All resources are deployed and managed in a resource group. To create a resource group:

1. Login to the Azure portal: https://portal.azure.com/

2. Click Resource groups in the left navigation pane and Click Create on Resource groups page.

A screenshot of a computer AI-generated content may be incorrect.

1. For Subscription, select the name of the Azure subscription in which you want to create the resource group.

2. Enter a unique name for the resource group, The system immediately checks to see if the name is available in the currently selected Azure subscription.

3. Select a Region for the resource group. Click Review + Create. Click Create again on next page.

A screenshot of a group AI-generated content may be incorrect.

Step 2 - Creating Event Hub Namespace

An Event Hub namespace provides a unique scoping container, referenced by its fully qualified domain name, in which you create one or more event hubs. To create a namespace in your resource group using the portal, complete the following steps:

1. In the Azure portal, click Create a resource at the top left of the screen.

A screenshot of a computer AI-generated content may be incorrect.

1. Search for Event Hubs, and then click the Create button in the Event Hubs page.

A screenshot of a computer AI-generated content may be incorrect.

1. On the Create namespace page, complete the following steps:

3.1 Select the subscription in which you want to create the namespace.

3.2 Select the Resource group for the namespace.

3.3 Enter a name for the namespace. The system immediately checks to see if the name is available.

3.4 Select a location for the namespace and choose the pricing tier “Standard"– required for additional, custom consumer groups other than $Default group.

3.5 Click Review + Create and then Create. This will take few minutes for the system to fully provision the resources.

3.6 Refresh the Event Hubs page to see the event hub namespace. You can check the status of the event hub creation in the alerts. Select the namespace. You see the home page for your Event Hubs Namespace in the portal.

A screenshot of a computer AI-generated content may be incorrect.

Step 3 - Creating an Event Hub

To Create an Event Hub within the namespace, follow these steps:

1. In the Event Hubs Namespace page, click Event Hubs in the left menu.

A screenshot of a computer AI-generated content may be incorrect.

1. At the top of the window, click + Event Hub.

A screenshot of a computer AI-generated content may be incorrect.

1. Choose an appropriate name for your event hub, then click Create

A screenshot of a computer AI-generated content may be incorrect.

1. After the event hub is created, you see it in the list of event hubs.

**Note:**This step is not required for all types of logs. Some log sources automatically create their own event hub like insights-logs-auditlogs, insights-logs-signinlogs, insights-activity- logs, others, within the namespace you created above. We recommend creating an Event Hub for sake of clarity.

Step 4 - Configure an Event Hub Namespace

To Generate Shared Access Policy for Event Hub Namespace you’ve created

1. Select event hub namespace and go to Shared access policies, and then click +Add. Enter the Policy name, check the Manage box, and then click Create.

A screenshot of a computer AI-generated content may be incorrect.

1. Click on the Shared Access policiesyou just created, make a note of the connection string primary key field for later use.

A screenshot of a computer AI-generated content may be incorrect.

1. BluSapphire collector requires the SAS Policy name (created in Step 4 - 1) and the connection string primary key when creating the credential in “blusapphire-sas". Copy the connection string primary key and policy name to a text editor for later use.

**Note:**When the event hub namespace is created, Azure will also create a default Shared Access Policy named RootManageSharedAcessKey.

1. Select an event hub namespace and go to respective Event Hub.

2. From the selected event hub, go to Consumer group within that event hub. Click +Consumer group to create a new consumer group.

A screenshot of a computer AI-generated content may be incorrect.

A screenshot of a login form AI-generated content may be incorrect.

**Note:**Please ensure you select Standard tier while creating Event Hub Namespace, this allows creating multiple Consumer Groups.

Step 5 - Enable Azure Firewall Logs to Event Hub

In Azure Portal:

1. Navigate to your Azure Firewall

2. Click Diagnostic Settings

3. Click + Add diagnostic setting

4. Under Logs – Categories select all the logs

5. Under Destination details select:** Send to Event Hub**

6. Choose:

7. Event Hub Namespace that you have created

8. Event Hub name that you have created

9. Save

After the above steps are completed, please share the below details.

Required Details	Azure Location
eventhub	Event Hub → Name
consumer_group	Event Hub → Consumer Groups
connection_string	Event Hub → Shared Access Policy
storage_account	Storage Account → Overview
storage_account_key	Storage Account → Access Keys