Monitor logs using Azure Firewall Workbook

Azure Firewall Workbook provides a flexible canvas for Azure Firewall data analysis. You can use it to create rich visual reports within the Azure portal. You can tap into multiple Firewalls deployed across Azure, and combine them into unified interactive experiences.

You can gain insights into Azure Firewall events, learn about your application and network rules, and see statistics for firewall activities across URLs, ports, and addresses. Azure Firewall Workbook allows you to filter your firewalls and resource groups, and dynamically filter per category with easy to read data sets when investigating an issue in your logs.

Prerequisites

Before starting, you should enable diagnostic logging through the Azure portal. Also, read Azure Firewall logs and metrics for an overview of the diagnostics logs and metrics available for Azure Firewall.

Get started

To deploy the workbook, go to Azure Monitor Workbook for Azure Firewall and following the instructions on the page. Azure Firewall Workbook is designed to work across multi-tenants, multi-subscriptions, and is filterable to multiple firewalls.

Overview page

The overview page provides you with a way to filter across workspaces, time, and firewalls. It shows events by time across firewalls and log types (application, networks, threat intel, DNS proxy).

Application rule log statistics

This page shows unique sources of IP address over time, application rule count usage, denied/allowed FQDN over time, and filtered data. You can filter data based on IP address.

The Web Categories view summarizes all allow and deny access log actions based on severity as configured by the firewall administrator.

Network rule log statistics

This page provides a view by rule action – allow/deny, target port by IP and DNAT over time. You can also filter by action, port, and destination type.

You can also filter logs based on time window:

IDPS log statistics

This page provides an overview of the IDPS actions count for all traffic that match the IDPS rules: Protocol, Signature ID, Source IP.

Investigations

You can look at the logs and understand more about the resource based on the source IP address. You can get information like virtual machine name and network interface name. It's simple to filter to the resource from the logs.

Next steps

• Learn more about Azure Firewall Diagnostics