Firewall Policy Idps Signatures - List

Service:

Virtual Networks

API Version:

2024-05-01

Retrieves the current status of IDPS signatures for the relevant policy. Maximal amount of returned signatures is 1000.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/firewallPolicies/{firewallPolicyName}/listIdpsSignatures?api-version=2024-05-01

URI Parameters

Name	In	Required	Type	Description
firewallPolicyName	path	True	string	The name of the Firewall Policy.
resourceGroupName	path	True	string	The name of the resource group.
subscriptionId	path	True	string	The subscription credentials which uniquely identify the Microsoft Azure subscription. The subscription ID forms part of the URI for every service call.
api-version	query	True	string	Client API version.

Request Body

Name	Type	Description
filters	FilterItems[]	Contain all filters names and values
orderBy	OrderBy	Column to sort response by
resultsPerPage	integer (int32) minimum: 1 maximum: 1000	The number of the results to return in each page
search	string	Search term in all columns
skip	integer (int32)	The number of records matching the filter to skip

Responses

Name	Type	Description
200 OK	QueryResults	Success. The operation returns an IDPS Query Response
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

query signature overrides

Sample request

HTTP

POST https://management.azure.com/subscriptions/e747cc13-97d4-4a79-b463-42d7f4e558f2/resourceGroups/rg1/providers/Microsoft.Network/firewallPolicies/firewallPolicy/listIdpsSignatures?api-version=2024-05-01

{
  "filters": [
    {
      "field": "Mode",
      "values": [
        "Deny"
      ]
    }
  ],
  "search": "",
  "orderBy": {
    "field": "severity",
    "order": "Ascending"
  },
  "resultsPerPage": 20,
  "skip": 0
}

Java

import com.azure.resourcemanager.network.models.FilterItems;
import com.azure.resourcemanager.network.models.FirewallPolicyIdpsQuerySortOrder;
import com.azure.resourcemanager.network.models.IdpsQueryObject;
import com.azure.resourcemanager.network.models.OrderBy;
import java.util.Arrays;

/**
 * Samples for FirewallPolicyIdpsSignatures List.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/network/resource-manager/Microsoft.Network/stable/2024-05-01/examples/
     * FirewallPolicyQuerySignatureOverrides.json
     */
    /**
     * Sample code: query signature overrides.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void querySignatureOverrides(com.azure.resourcemanager.AzureResourceManager azure) {
        azure.networks().manager().serviceClient().getFirewallPolicyIdpsSignatures()
            .listWithResponse("rg1", "firewallPolicy", new IdpsQueryObject()
                .withFilters(Arrays.asList(new FilterItems().withField("Mode").withValues(Arrays.asList("Deny"))))
                .withSearch("")
                .withOrderBy(new OrderBy().withField("severity").withOrder(FirewallPolicyIdpsQuerySortOrder.ASCENDING))
                .withResultsPerPage(20).withSkip(0), com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from azure.identity import DefaultAzureCredential

from azure.mgmt.network import NetworkManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-network
# USAGE
    python firewall_policy_query_signature_overrides.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = NetworkManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="e747cc13-97d4-4a79-b463-42d7f4e558f2",
    )

    response = client.firewall_policy_idps_signatures.list(
        resource_group_name="rg1",
        firewall_policy_name="firewallPolicy",
        parameters={
            "filters": [{"field": "Mode", "values": ["Deny"]}],
            "orderBy": {"field": "severity", "order": "Ascending"},
            "resultsPerPage": 20,
            "search": "",
            "skip": 0,
        },
    )
    print(response)


# x-ms-original-file: specification/network/resource-manager/Microsoft.Network/stable/2024-05-01/examples/FirewallPolicyQuerySignatureOverrides.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armnetwork_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/ab04533261eff228f28e08900445d0edef3eb70c/specification/network/resource-manager/Microsoft.Network/stable/2024-05-01/examples/FirewallPolicyQuerySignatureOverrides.json
func ExampleFirewallPolicyIdpsSignaturesClient_List() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armnetwork.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewFirewallPolicyIdpsSignaturesClient().List(ctx, "rg1", "firewallPolicy", armnetwork.IDPSQueryObject{
		Filters: []*armnetwork.FilterItems{
			{
				Field: to.Ptr("Mode"),
				Values: []*string{
					to.Ptr("Deny")},
			}},
		OrderBy: &armnetwork.OrderBy{
			Field: to.Ptr("severity"),
			Order: to.Ptr(armnetwork.FirewallPolicyIDPSQuerySortOrderAscending),
		},
		ResultsPerPage: to.Ptr[int32](20),
		Search:         to.Ptr(""),
		Skip:           to.Ptr[int32](0),
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.QueryResults = armnetwork.QueryResults{
	// 	MatchingRecordsCount: to.Ptr[int64](2),
	// 	Signatures: []*armnetwork.SingleQueryResult{
	// 		{
	// 			Description: to.Ptr("P2P Phatbot Control Connection"),
	// 			DestinationPorts: []*string{
	// 				to.Ptr("any")},
	// 				Direction: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureDirectionTwo),
	// 				Group: to.Ptr("A Network Trojan was detected"),
	// 				InheritedFromParentPolicy: to.Ptr(false),
	// 				LastUpdated: to.Ptr("2010-07-30T00:00:00"),
	// 				Mode: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureModeTwo),
	// 				Severity: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureSeverityOne),
	// 				SignatureID: to.Ptr[int32](2000015),
	// 				SourcePorts: []*string{
	// 					to.Ptr("any")},
	// 					Protocol: to.Ptr("tcp"),
	// 				},
	// 				{
	// 					Description: to.Ptr("WEB_SERVER SQL sp_delete_alert attempt"),
	// 					DestinationPorts: []*string{
	// 						to.Ptr("any")},
	// 						Direction: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureDirectionOne),
	// 						Group: to.Ptr("Attempted User Privilege Gain"),
	// 						InheritedFromParentPolicy: to.Ptr(false),
	// 						LastUpdated: to.Ptr("2019-09-27T00:00:00"),
	// 						Mode: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureModeTwo),
	// 						Severity: to.Ptr(armnetwork.FirewallPolicyIDPSSignatureSeverityOne),
	// 						SignatureID: to.Ptr[int32](2000106),
	// 						SourcePorts: []*string{
	// 							to.Ptr("any")},
	// 							Protocol: to.Ptr("http"),
	// 					}},
	// 				}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Retrieves the current status of IDPS signatures for the relevant policy. Maximal amount of returned signatures is 1000.
 *
 * @summary Retrieves the current status of IDPS signatures for the relevant policy. Maximal amount of returned signatures is 1000.
 * x-ms-original-file: specification/network/resource-manager/Microsoft.Network/stable/2024-05-01/examples/FirewallPolicyQuerySignatureOverrides.json
 */
async function querySignatureOverrides() {
  const subscriptionId =
    process.env["NETWORK_SUBSCRIPTION_ID"] || "e747cc13-97d4-4a79-b463-42d7f4e558f2";
  const resourceGroupName = process.env["NETWORK_RESOURCE_GROUP"] || "rg1";
  const firewallPolicyName = "firewallPolicy";
  const parameters = {
    filters: [{ field: "Mode", values: ["Deny"] }],
    orderBy: { field: "severity", order: "Ascending" },
    resultsPerPage: 20,
    search: "",
    skip: 0,
  };
  const credential = new DefaultAzureCredential();
  const client = new NetworkManagementClient(credential, subscriptionId);
  const result = await client.firewallPolicyIdpsSignatures.list(
    resourceGroupName,
    firewallPolicyName,
    parameters,
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Network.Models;
using Azure.ResourceManager.Network;

// Generated from example definition: specification/network/resource-manager/Microsoft.Network/stable/2024-05-01/examples/FirewallPolicyQuerySignatureOverrides.json
// this example is just showing the usage of "FirewallPolicyIdpsSignatures_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this FirewallPolicyResource created on azure
// for more information of creating FirewallPolicyResource, please refer to the document of FirewallPolicyResource
string subscriptionId = "e747cc13-97d4-4a79-b463-42d7f4e558f2";
string resourceGroupName = "rg1";
string firewallPolicyName = "firewallPolicy";
ResourceIdentifier firewallPolicyResourceId = FirewallPolicyResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, firewallPolicyName);
FirewallPolicyResource firewallPolicy = client.GetFirewallPolicyResource(firewallPolicyResourceId);

// invoke the operation
IdpsQueryContent content = new IdpsQueryContent
{
    Filters = {new IdpsQueryFilterItems
    {
    Field = "Mode",
    Values = {"Deny"},
    }},
    Search = "",
    OrderBy = new IdpsQueryOrderBy
    {
        Field = "severity",
        Order = FirewallPolicyIdpsQuerySortOrder.Ascending,
    },
    ResultsPerPage = 20,
    Skip = 0,
};
IdpsSignatureListResult result = await firewallPolicy.GetFirewallPolicyIdpsSignatureAsync(content);

Console.WriteLine($"Succeeded: {result}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "signatures": [
    {
      "signatureId": 2000015,
      "mode": 2,
      "severity": 1,
      "direction": 2,
      "group": "A Network Trojan was detected",
      "description": "P2P Phatbot Control Connection",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2010-07-30T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "tcp"
    },
    {
      "signatureId": 2000106,
      "mode": 2,
      "severity": 1,
      "direction": 1,
      "group": "Attempted User Privilege Gain",
      "description": "WEB_SERVER SQL sp_delete_alert attempt",
      "sourcePorts": [
        "any"
      ],
      "destinationPorts": [
        "any"
      ],
      "lastUpdated": "2019-09-27T00:00:00",
      "inheritedFromParentPolicy": false,
      "protocol": "http"
    }
  ],
  "matchingRecordsCount": 2
}

Definitions

Name	Description
CloudError	An error response from the service.
CloudErrorBody	An error response from the service.
FilterItems	Will contain the filter name and values to operate on
FirewallPolicyIDPSQuerySortOrder	Describes if results should be in ascending/descending order
FirewallPolicyIDPSSignatureDirection	Describes in which direction signature is being enforced: 0 - OutBound, 1 - InBound, 2 - Any, 3 - Internal, 4 - InternalOutbound, 5 - InternalInbound
FirewallPolicyIDPSSignatureMode	The current mode enforced, 0 - Disabled, 1 - Alert, 2 -Deny
FirewallPolicyIDPSSignatureSeverity	Describes the severity of signature: 1 - High, 2 - Medium, 3 - Low
IDPSQueryObject	Will describe the query to run against the IDPS signatures DB
OrderBy	Describes a column to sort
QueryResults	Query result
SingleQueryResult

CloudError

Object

An error response from the service.

Name	Type	Description
error	CloudErrorBody	Cloud error body.

CloudErrorBody

Object

An error response from the service.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
details	CloudErrorBody[]	A list of additional details about the error.
message	string	A message describing the error, intended to be suitable for display in a user interface.
target	string	The target of the particular error. For example, the name of the property in error.

FilterItems

Object

Will contain the filter name and values to operate on

Name	Type	Description
field	string	The name of the field we would like to filter
values	string[]	List of values to filter the current field by

FirewallPolicyIDPSQuerySortOrder

Enumeration

Describes if results should be in ascending/descending order

Value	Description
Ascending
Descending

FirewallPolicyIDPSSignatureDirection

Enumeration

Describes in which direction signature is being enforced: 0 - OutBound, 1 - InBound, 2 - Any, 3 - Internal, 4 - InternalOutbound, 5 - InternalInbound

Value	Description
0
1
2
3
4
5

FirewallPolicyIDPSSignatureMode

Enumeration

The current mode enforced, 0 - Disabled, 1 - Alert, 2 -Deny

Value	Description
0
1
2

FirewallPolicyIDPSSignatureSeverity

Enumeration

Describes the severity of signature: 1 - High, 2 - Medium, 3 - Low

Value	Description
1
2
3

IDPSQueryObject

Object

Will describe the query to run against the IDPS signatures DB

Name	Type	Description
filters	FilterItems[]	Contain all filters names and values
orderBy	OrderBy	Column to sort response by
resultsPerPage	integer (int32) minimum: 1 maximum: 1000	The number of the results to return in each page
search	string	Search term in all columns
skip	integer (int32)	The number of records matching the filter to skip

OrderBy

Object

Describes a column to sort

Name	Type	Description
field	string	Describes the actual column name to sort by
order	FirewallPolicyIDPSQuerySortOrder	Describes if results should be in ascending/descending order

QueryResults

Object

Query result

Name	Type	Description
matchingRecordsCount	integer (int64)	Number of total records matching the query.
signatures	SingleQueryResult[]	Array containing the results of the query

SingleQueryResult

Object

Name	Type	Description
description	string	Describes what is the signature enforces
destinationPorts	string[]	Describes the list of destination ports related to this signature
direction	FirewallPolicyIDPSSignatureDirection (int32)	Describes in which direction signature is being enforced: 0 - OutBound, 1 - InBound, 2 - Any, 3 - Internal, 4 - InternalOutbound, 5 - InternalInbound
group	string	Describes the groups the signature belongs to
inheritedFromParentPolicy	boolean	Describes if this override is inherited from base policy or not
lastUpdated	string	Describes the last updated time of the signature (provided from 3rd party vendor)
mode	FirewallPolicyIDPSSignatureMode (int32)	The current mode enforced, 0 - Disabled, 1 - Alert, 2 -Deny
protocol	string	Describes the protocol the signatures is being enforced in
severity	FirewallPolicyIDPSSignatureSeverity (int32)	Describes the severity of signature: 1 - High, 2 - Medium, 3 - Low
signatureId	integer (int32)	The ID of the signature
sourcePorts	string[]	Describes the list of source ports related to this signature