Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Usecase if IDS/IPS turned off on firewall ( In azure sentinel ) @Azure

Copper Contributor

Want to create one use case  if IDS/IPS turned off on firewall ( In azure sentinel ). Can any one help with Kusto query for this. 

3 Replies
best response confirmed by ankit976 (Copper Contributor)
Solution
You don't mention which Firewall. Azure Firewall, logs IPS/IDS so you can start a query with AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" | where OperationName == "AzureFirewallIDSLog"
But by this we can not find whether IDS turnoff or not.........there is field msg_s in that i guess we will get "off". so query can be
AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" | where OperationName == "AzureFirewallIDSLog" | where msg_s contains "off"

Now i am in doubt about that off things
I was thinking if you have data returned by that Query then IDS must be "ON", you could then test to see when data was last sent?
1 best response

Accepted Solutions
best response confirmed by ankit976 (Copper Contributor)
Solution
You don't mention which Firewall. Azure Firewall, logs IPS/IDS so you can start a query with AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" | where OperationName == "AzureFirewallIDSLog"

View solution in original post