path "/SUBSCRIPTIONS/5B0F54C4-6B83-44E7-A71F-E02E4C5CEFDC/RESOURCEGROUPS/HUB-NETWORK-EASTUS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZUREFIREWALL_SHD-HUB-EASTUS-VHUB"

Suman Majhi 0

We got security alert ,please suggest of the activity which kind of activity is it ? alert details is mentioned below

communication Type : Outbound

Name : AZFWIdpsSignature

Message : POLICY Vulnerable Java Version 1.8.x Detected

KapilAnanth-MSFT 46,681 Reputation points Microsoft Employee

2023-08-25T05:32:51.7733333+00:00
@Suman Majhi

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

As the name suggests, this Alert comes from your Azure Firewall Premium which has IDPS

Can you please provide more info on this?

Did you get the alert on the Portal?

What happens when you click the alert?

Does it give you a time and source/Destination IP?

You can also check the Azure Firewall logs and see if this is logged.

That should give some more information on why it is triggered.

AzFW Logs :

https://learn.microsoft.com/en-us/azure/firewall/firewall-structured-logs

https://learn.microsoft.com/en-us/azure/firewall/firewall-diagnostics#view-and-analyze-the-network-and-application-rule-logs

Cheers,

Kapil
KapilAnanth-MSFT 46,681 Reputation points Microsoft Employee

2023-08-28T07:08:31.7+00:00

@Suman Majhi

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth-MSFT 46,681 Reputation points Microsoft Employee

2023-08-29T04:54:11.5066667+00:00

@Suman Majhi

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

1 answer

KapilAnanth-MSFT 46,681 Reputation points Microsoft Employee

2023-08-29T13:42:43.9933333+00:00
@Suman Majhi

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

This Alert comes from your Azure Firewall Premium which has IDPS enabled.

It appears you had enabled Structured Logs in the Azure Firewall, and this is what is giving the alert.

Please refer to the below documents for further information,

Azure Structured Firewall Logs | Microsoft Learn

Azure Monitor Logs reference - AZFWIdpsSignature | Microsoft Learn

Azure Firewall IDPS signature rule categories | Microsoft Learn

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

path "/SUBSCRIPTIONS/5B0F54C4-6B83-44E7-A71F-E02E4C5CEFDC/RESOURCEGROUPS/HUB-NETWORK-EASTUS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZUREFIREWALL_SHD-HUB-EASTUS-VHUB"

1 answer

Your answer