Configure Logging for Cloud NGFW on Azure
Table of Contents
Expand all | Collapse all
-
- About Rulestacks and Rules on Cloud NGFW for Azure
- Create a Rulestack on Cloud NGFW for Azure
- Cloud NGFW for Azure Security Rule Objects
- Create a Prefix List on Cloud NGFW for Azure
- Create an FQDN List for Cloud NGFW on Azure
- Add a Certificate to Cloud NGFW for Azure
- Create Security Rules on Cloud NGFW for Azure
- Cloud NGFW for Azure Security Services
- Enable DNS Security on Cloud NGFW for Azure
- Set Up Outbound Decryption on Cloud NGFW for Azure
- Set Up Inbound Decryption on Cloud NGFW for Azure
-
- Configure Logging for Cloud NGFW on Azure
- Cloud NGFW for Azure Traffic Log Fields
- Cloud NGFW for Azure Threat Log Fields
- Cloud NGFW for Azure Decryption Log Fields
- Enable Log Settings
- Disable Log Settings
- Enable Activity Logging on Cloud NGFW for Azure
- Multiple Logging Destinations on Cloud NGFW for Azure
- View the Logs
- View Audit Logs on a Firewall Resource
- View Audit Logs on Resource Groups
- What's New
- Cloud NGFW for Azure Known Issues
- Cloud NGFW for Azure Addressed Issues
Configure Logging for Cloud NGFW on Azure
A log is an automatically generated, time-stamped
file that provides an audit trail for system events on the firewall
or network traffic events that the firewall monitors. Log entries
contain artifacts, which are properties, activities, or behaviors
associated with the logged event, such as the application type or
the IP address of an attacker. Each log type records information
for a separate event type. For example, the firewall generates a
Threat log to record traffic that matches a spyware, vulnerability,
or virus signature or a DoS attack that matches the thresholds configured for
a port scan or host sweep activity on the firewall.
The Cloud NGFW can send traffic, threat, and decryption logs to an Azure Log
Analytics Workspace that you will create in the Azure portal. The
Log Analytics Workspace is associated with a workspace ID, Primary
Key, and a secondary key which is retrieved through the logging
API by the control plane.
Log Types
Cloud NGFW can capture and save three types
of logs.
- Traffic—Traffic logs display an entry for the start and end of each session. See Cloud NGFW for Azure Traffic Log Fields for more information.
- Threat—Threat logs display entries when traffic matches one of the security profiles attached to a security rule on the firewall. Each entry includes the following information: date and time; type of threat (such as virus or spyware); threat description or URL (Name column); alarm action (such as allow or block); and severity level.See Cloud NGFW for Azure Threat Log Fields for more information.SeverityDescriptionCriticalSerious threats, such as those that affect default installations of widely deployed software, result in root compromise of servers, and the exploit code is widely available to attackers. The attacker usually does not need any special authentication credentials or knowledge about the individual victims and the target does not need to be manipulated into performing any special functions.HighThreats that have the ability to become critical but have mitigating factors; for example, they may be difficult to exploit, do not result in elevated privileges, or do not have a large victim pool.MediumMinor threats in which impact is minimized, such as DoS attacks that do not compromise the target or exploits that require an attacker to reside on the same LAN as the victim, affect only non-standard configurations or obscure applications, or provide very limited access.LowWarning-level threats that have very little impact on an organization's infrastructure. They usually require local or physical system access and may often result in victim privacy or DoS issues and information leakage.InformationalSuspicious events that do not pose an immediate threat, but that are reported to call attention to deeper problems that could possibly exist. URL Filtering log entries are logged as Informational. Log entries with any verdict and an action set to block are logged as Informational.
- Decryption—Decryption logs display entries for unsuccessful TLS handshakes by default and can display entries for successful TLS handshakes if you enable them in Decryption policy. If you enable entries for successful handshakes, ensure that you have the system resources (log space) for the logs. See Cloud NGFW for Azure Decryption Log Fields for more information.