Azure Firewall IDPS

Yang, Steven 151

Hello,

How do I get an export of all the IDPS signature rules? I don't see that option in the firewall policy GUI.

Also, i'm testing out this list api: https://learn.microsoft.com/en-us/rest/api/virtualnetwork/firewall-policy-idps-signatures/list as a way to retrieve idps rule, and I believe the filter for direction is buggy. see screenshot.

1st image shows that i request rules in outbound direction. the api returns rules in all direction (2nd image)

User's image

KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-08-30T13:19:31.4333333+00:00
@Yang, Steven

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to Retrieve IDPS rules via API.

I see you are using the filter,

direction = ['outbound']

Instead, can you try

direction = [1]

and let us know the behavior?

Cheers,

Kapil
Yang, Steven 151 Reputation points

2023-08-30T19:23:22.58+00:00

@KapilAnanth-MSFT i tried the number as well, but didn't work.

I would like to get an export of the idps signature rules. Doesn't have to be through API (which i would prefer actually).
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-08-31T07:20:53.7233333+00:00
@Yang, Steven

I tested this API and the fact is that the API isn't buggy, rather, the documentation is incorrect.

After lots of trial and error, the values for "Direction" are as follows:

Outbound - 0

Inbound - 1

Bidirectional - 2

Internal - 3

Internal/Outbound - 4

Please use the "String" in the HTTP Request body.

And the returned Response body would contain the integer representation.

Hope this helps.

Meanwhile, I shall reach out internally to the respective team and inform them of the documentation issue.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil
Yang, Steven 151 Reputation points

2023-08-31T11:03:04.4733333+00:00

@KapilAnanth-MSFT - can you show me what you tried? it did not work for me.

tried: "Outbound - 0" or "Outbound" would give me result contain direction=2.

Even if it works as you statement, it is not user-friendly..so suggest msft make a change here.
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-08-31T11:18:17.2266667+00:00
@Yang, Steven

This was the request body I used

{ "filters": [ { "field": "Direction", "values": ["Outbound"] } ], "orderBy": { "field": "Direction", "order": "Ascending" } }

Wrt, "it is not user-friendly."

I totally agree

I have reached out the respective team with the API's Request/Response behavior

Cheers,

Kapil

Yang, Steven 151

that didn't work for me. I have more filters.

{
    "filters": [
      {
        "field": "severity",
        "values":[
          "High"
         ],
        "field": "Direction",
        "values":["Outbound"],
        "field": "group",
        "values":[
          "A Network Trojan was detected",
          "Exploit Kit Activity Detected",
          "Attempted Administrator Privilege Gain",
          "Targeted Malicious Activity was Detected"
         ]
      }
    ],
    "search": "",
    "orderBy": {
      "field": "severity",
      "order": "Ascending"
    },
    "skip": 0
  }

output:

{
  "signatures": [
    {
      "signatureId": 2000015,
      "mode": 1,
      "severity": 1,
      "direction": 2,
      "group": "A Network Trojan was detected",
      "description": "P2P Phatbot Control Connection",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2010-07-30T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "tcp",
      "alertOnly": true,
      "modeDefinedBy": 1
    },
    {
      "signatureId": 2000347,
      "mode": 2,
      "severity": 1,
      "direction": 0,
      "group": "A Network Trojan was detected",
      "description": "MALWARE IRC Private message on non-standard port",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "!6666:7000"
      ],
      "lastUpdated": "2022-05-03T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "tcp",
      "alertOnly": false,
      "modeDefinedBy": 0
    },
    {
      "signatureId": 2001616,
      "mode": 2,
      "severity": 1,
      "direction": 0,
      "group": "A Network Trojan was detected",
      "description": "ATTACK_RESPONSE Zone-H.org defacement notification",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2020-08-24T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "http",
      "alertOnly": false,
      "modeDefinedBy": 0
    },
    {
      "signatureId": 2001743,
      "mode": 2,
      "severity": 1,
      "direction": 1,
      "group": "A Network Trojan was detected",
      "description": "MALWARE HackerDefender Root Kit Remote Connection Attempt Detected",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2010-07-30T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "tcp",
      "alertOnly": false,
      "modeDefinedBy": 0
    },
    {
      "signatureId": 2001891,
      "mode": 2,
      "severity": 1,
      "direction": 0,
      "group": "A Network Trojan was detected",
      "description": "USER_AGENTS Suspicious User Agent (agent)",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2020-09-17T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "http",
      "alertOnly": false,
      "modeDefinedBy": 0
    },
    {
      "signatureId": 2002029,
      "mode": 2,
      "severity": 1,
      "direction": 1,
      "group": "A Network Trojan was detected",
      "description": "MALWARE IRC Channel topic scan/exploit command",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2010-07-30T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "tcp",
      "alertOnly": false,
      "modeDefinedBy": 0
    },

KapilAnanth-MSFT 47,491 Microsoft Employee

@Yang, Steven

Your filters should be a list of JSON Object.

{

"filters": [
      {
        "field": "severity",
        "values":[
          "High"
         ]
	},

	{	
        "field": "Direction",
        "values":["Outbound"]
	},
    {    "field": "group",
        "values":[
          "A Network Trojan was detected",
          "Exploit Kit Activity Detected",
          "Attempted Administrator Privilege Gain",
          "Targeted Malicious Activity was Detected"
         ]
      }
    ],


"orderBy": {
"field": "severity",
"order": "Ascending"
},


}

No need to add "skip" and "search" if you are not going to use it

Try the above and let me know the results

Yang, Steven 151 Reputation points

2023-08-31T11:32:48.66+00:00

ah. got it. thank you!
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-08-31T11:35:10.5966667+00:00

@Yang, Steven

You are most welcome.

I shall work internally so your feedback gets traction.

Meanwhile, I shall summarize my comments and post it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil

Accepted answer

KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-08-31T11:37:04.61+00:00
@Yang, Steven

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I tested this API and the fact is that the API isn't buggy, rather, the documentation is not up to date.

The values for "Direction" are as follows:

Outbound - 0

Inbound - 1

Bidirectional - 2

Internal - 3

Internal/Outbound - 4

Please use the "String" in the HTTP Request body.

And the returned Response body would contain the integer representation.

I shall work internally to the respective team and inform them of the documentation issue and mismatch between Request and Response parameter arguments.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Firewall IDPS

0 additional answers

Your answer