You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
az-firewall-mon once installed in your environmentwill result in the following architecture:
3
+
When installed in your environment, `az-firewall-mon`will deploy the following resources:
4
4
5
-
5
+
6
6
7
-
The steps to follow to install a private copy of az-firewall-mon in your environment are:
7
+
Follow these steps to install a private copy of `az-firewall-mon` in your environment:
8
8
9
9
* Fork the GitHub repository
10
10
* Create a GitHub Personal Access Token (PAT)
11
11
* Create all Azure resources
12
12
* Configure the GitHub Action to deploy both the SPA and the backend API
13
-
* Environment variables
14
-
13
+
* Review Environment variables
14
+
* Limit access
15
+
15
16
# Fork the GitHub repository
16
17
17
-
The first thing to do is clone the az-firewall-mon repository. This will also allow you to pull down and build the latest changes and updates from the original repo while having the stability of maintaining your own personal copy.
18
+
The first step is to fork the `az-firewall-mon` repository. This allows you to pull down and build the latest changes and updates from the original repository while maintaining your own personal copy.
18
19
19
-
* Navigate to: <https://github.com/nicolgit/azure-firewall-mon>.
20
-
* Click Fork > create a new fork (top right of the repository)
21
-
* Click [Create fork]
20
+
* Navigate to: <https://github.com/nicolgit/azure-firewall-mon>
21
+
* Click **Fork** > **Create a new fork** (top right of the repository)
22
+
* Click **Create fork**
22
23
23
-
> You have now a fork of the 'az-firewall-mon' repository; when a new update comes out - you can also select 'Sync fork' - to keep your fork up-to-date and trigger a new build.
24
+
> You now have a fork of the `az-firewall-mon` repository. When a new update is available, you can select **Sync fork** to keep your fork up-to-date and trigger a new build.
24
25
25
26
# Create a GitHub Personal Access Token (PAT)
26
27
@@ -36,44 +37,52 @@ The first thing to do is clone the az-firewall-mon repository. This will also al
36
37
8.**Copy your token** (you won't be able to see it again)
37
38
38
39
# Create all Azure resources
39
-
An instance of `az-firewall-mon`is composed of:
40
+
An instance of `az-firewall-mon`consists of:
40
41
* 1 Azure Static Web App (standard plan)
41
42
* 1 Azure Maps account
42
43
* 1 Azure OpenAI account
43
44
* 1 Application Insights instance
44
45
45
-
All these resources can be deployed to your subscription by clicking the button below:
46
+
You can deploy all these resources to your subscription by clicking the button below:
46
47
47
48
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fnicolgit%2Fazure-firewall-mon%2Fmain%2Fbicep%2Fsetup.json)
48
49
49
-
Remember to fill in the following parameters:
50
+
When deploying, fill in the following parameters:
50
51
-`staticWebAppName`: Name for your static web app
51
52
-`repositoryUrl`: Your GitHub repository URL (e.g., `https://github.com/username/azure-firewall-mon`)
52
-
-`repositoryToken`: Your GitHub PAT created in the above paragraph
53
-
-`branch`: Your main branch ('main')
53
+
-`repositoryToken`: Your GitHub PAT created in the previous step
54
+
-`branch`: Your main branch (typically 'main')
54
55
55
-
This will create an action in your repository that will build and deploy the solution to Azure.
56
+
This will create also an action in your repository that builds and deploys the solution to Azure.
56
57
57
-
Go to <https://github.com/YOURGITHUBACCOUNT/azure-firewall-mon/actions> to see the deployment status. When deployment is complete, go to Azure Portal > Static Web Apps > View app in browser
58
+
Go to `https://github.com/YOUR-GITHUB-ACCOUNT/azure-firewall-mon/actions` to see the deployment status. When deployment is complete, navigate to Azure Portal > Static Web Apps > View app in browser
58
59
59
-
# Environment variables
60
+
# Review environment variables
60
61
61
-
az-firewall-mon requires a few environment variables to work. These variables are configured automatically by the deployment. Here's the reference in case you want to change any:
62
+
`az-firewall-mon` requires several environment variables to function properly. These variables are configured automatically during deployment. Here's a reference in case you need to change any:
IP API will return a 429 status code if you make more than 1 call to IP API per second (1000 milliseconds)
71
+
With these settings IP API will return a `429` status code if you make more than 1 call to IP API per second (1000 milliseconds)
71
72
72
-
Azure OpenAI settings
73
+
Azure OpenAI settings:
73
74
***aoai_api_key**: Azure OpenAI key
74
75
***aoai_endpoint**: Azure OpenAI endpoint
75
76
***aoai_deployment**: Azure OpenAI deployment name
76
-
77
77
***llm_throttling_calls**: '5'
78
78
***llm_throttling_window_milliseconds**: '60000'
79
-
Chat API will return a 429 status code if you make more than 5 calls per minute (60000 milliseconds)
79
+
80
+
With these settings Chat API will return a `429` status code if you make more than 5 calls per minute (60000 milliseconds)
81
+
82
+
# Limit access
83
+
After setup is complete, anyone with a valid Microsoft account can access your copy of `az-firewall-mon`. If you want to restrict access, you have several options:
84
+
85
+
*[Static Web App Private Endpoint](https://learn.microsoft.com/en-us/azure/static-web-apps/private-endpoint): Expose `az-firewall-mon` on a private IP in your virtual network connected via site-to-site VPN or ExpressRoute to your intranet. This makes the tool available only to your company's employees.
86
+
87
+
*[Static Web App Authorization](https://learn.microsoft.com/en-us/azure/static-web-apps/authentication-authorization): Since `az-firewall-mon` is a Microsoft account-authenticated app, you can configure a list of emails authorized to access it. The file to update, `staticwebapp.config.json`, is located in [./firewall-mon-app/src/assets](./firewall-mon-app/src/assets/staticwebapp.config.json).
We all know that Microsoft's recommended approach for analysing Azure Firewall logs is to set up a Log Analytics Workspace to collect all the data and use Kusto (KQL) queries to check the results.
24
+
We all know that Microsoft's recommended approach for analyzing Azure Firewall logs is to set up a Log Analytics Workspace to collect all the data and use Kusto Query Language (KQL) queries to check the results.
25
25
26
-
Azure-Firewall-mon focuses more on providing a tool that can answer the simple question "_what is happening right now?_" in an alternative and hopefully practical way: the idea is to provide an approach much more like [Sysinternals Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) or [Check Point's SmartView/SmartLog](https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMonitoring_AdminGuide/Topics-LMG/Using-log-view.htm?tocpath=Logging%7C_____2), where there is no KUSTO queries or dashboards that you need to implement first to get working. Still, all events are available as a _log-stream_.
26
+
Azure-Firewall-mon focuses more on providing a tool that can answer the simple question "_what is happening right now?_" in an alternative and practical way. The idea is to provide an approach similar to [Sysinternals Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) or [Check Point's SmartView/SmartLog](https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMonitoring_AdminGuide/Topics-LMG/Using-log-view.htm?tocpath=Logging%7C_____2), where you don't need to implement KQL queries or dashboards first to get it working. All events are available as a _log-stream_.
27
27
28
28
The real strength of the tool is the search field available in the top toolbar. To search for an event, simply start typing and the log flow will be automatically filtered according to those parameters.
29
29
@@ -33,7 +33,7 @@ The timestamp field displays the event date in UTC or local format. You can filt
33
33
34
34
35
35
36
-
Within this tool, only events from the last 24 hours will appear because this is the duration set on the Event Hub Namespace. A longer duration would slow down the tool and not help answer the question "_what is happening right now_" that az-firewall-mon aims to address.
36
+
Within this tool, only events from the last 24 hours will appear because this is the duration set on the Event Hub Namespace. A longer duration would slow down the tool and not help answer the question "_what is happening right now?_" that az-firewall-mon aims to address.
37
37
38
38
As an alternative to full-text search, you can use the **chatGPT mode**: in the top search field, you can enter a request in natural language, and the system will filter the content accordingly.
39
39
@@ -51,20 +51,20 @@ Some examples of queries are as follows:
51
51
52
52
53
53
# Set up a connection with your Azure Firewall
54
-
Azure-Firewall-mon is an opensource,[Single Page Application](https://en.wikipedia.org/wiki/Single-page_application), written in [Angular](https://angular.io/) with an [Azure function](https://learn.microsoft.com/en-us/azure/azure-functions/functions-overview) backend written in C# .NET.
54
+
Azure-Firewall-mon is an open-source [Single Page Application](https://en.wikipedia.org/wiki/Single-page_application) written in [Angular](https://angular.io/) with an [Azure Functions](https://learn.microsoft.com/en-us/azure/azure-functions/functions-overview) backend written in C# .NET.
55
55
56
56
Here's the current architecture:
57
57
58
58
59
59
60
-
To use this app with **YOUR FIREWALL data** you have 2 options:
60
+
To use this app with **YOUR FIREWALL data**, you have 2 options:
61
61
62
-
1. Use Azure Firewall mon sample deployment available at <https://az-firewall-mon.duckiesfarm.com>
62
+
1. Use the Azure Firewall mon sample deployment available at <https://az-firewall-mon.duckiesfarm.com>
63
63
2. Deploy Azure Firewall mon in your environment
64
64
65
-
The recommended option is number 2, because this way you are 100% sure your logs are not going outside your environment. I suggest you use the public deployment only for testing purposes.
65
+
The recommended option is number 2, as this way you can be 100% sure your logs are not going outside your environment. I suggest using the public deployment only for testing purposes.
66
66
67
-
> <https://az-firewall-mon.duckiesfarm.com> uses resources of my subscription (Azure Maps API, Azure OpenAI, Azure Static Web App Standard). These resources have a cost, so consider that I am limiting their cost as much as possible. The result is that the tool can be quite slow. In your deployment, you can dedicate more resources and also have better performance.
67
+
> <https://az-firewall-mon.duckiesfarm.com> uses resources from my subscription (Azure Maps API, Azure OpenAI, Azure Static Web App Standard). These resources have a cost, so I am limiting their usage as much as possible. As a result, the tool may be quite slow. In your own deployment, you can dedicate more resources and achieve better performance.
68
68
69
69
# Use az-firewall-mon sample deployment
70
70
To use this version with your data, you must perform the following steps on your Azure Subscription:
@@ -78,11 +78,11 @@ To use this version with your data, you must perform the following steps on your
78
78
- Select the Event Hub Namespace and Hub created above
79
79
- click `SAVE`
80
80
81
-
If you are a lazy engineer, like me, you can perform all these steps by clicking the following button😊
81
+
If you are a lazy engineer, like me, you can perform all these steps by clicking the following button😊
82
82
83
83
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fnicolgit%2Fazure-firewall-mon%2Fmain%2Fbicep%2Ffirewall-mon-azure-stuff.json)
84
84
85
-
Open the Azure Firewall instance you want to monitor from Azure portal, go to Monitoring > Diagnostic Settings > Add Diagnostic Settings:
85
+
Open the Azure Firewall instance you want to monitor from the Azure portal, go to Monitoring > Diagnostic Settings > Add Diagnostic Settings:
86
86
87
87
* Select all logs and "Stream to Event Hub"
88
88
* Select the Event Hub Namespace and Hub created above
@@ -96,27 +96,27 @@ Now, open <https://az-firewall-mon.duckiesfarm.com/> and do the following:
96
96
97
97
# Install az-firewall-mon in your environment
98
98
99
-
To install az-firewall-mon in your environment, follow [this guide](INSTALL.md). Once the instance is ready and working, you can go back and follow instructions in the [Use az-firewall-mon sample deployment](#use-az-firewall-mon-sample-deployment) section. Just change the URL with the one of your deployment.
99
+
To install az-firewall-mon in your environment, follow [this guide](INSTALL.md). Once the instance is ready and working, you can go back and follow the instructions in the [Use az-firewall-mon sample deployment](#use-az-firewall-mon-sample-deployment) section. Just replace the URL with the one from your deployment.
100
100
101
101
# More Information
102
102
103
-
[Azure Firewall](https://learn.microsoft.com/en-us/azure/firewall/overview) (AF) is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure. It's a fully stateful, firewall as a service with built-in high availability and unrestricted cloud scalability. It provides both east-west and north-south traffic inspection.
103
+
[Azure Firewall](https://learn.microsoft.com/en-us/azure/firewall/overview) (AF) is a cloud-native and intelligent network firewall security service that provides best-of-breed threat protection for your cloud workloads running in Azure. It's a fully stateful, firewall-as-a-service with built-in high availability and unrestricted cloud scalability. It provides both east-west and north-south traffic inspection.
104
104
105
105
[Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) helps you maximize the availability and performance of your applications and services. It delivers a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments.
106
106
107
-
AF (Azure-Firewall-Mon) is integrated with Azure Monitor. This means you can forward AF metrics and logs to:
107
+
AzureFirewall is integrated with Azure Monitor. This means you can forward Azure Firewall metrics and logs to:
108
108
109
109
* Log Analytics Workspace
110
110
* Azure Storage
111
-
* Event hub
111
+
* Event Hub
112
112
113
113
A [Log Analytics workspace](https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview) is a unique environment for log data from Azure Monitor and other Azure services. Each workspace has its own data repository and configuration but might combine data from multiple services.
114
114
115
-
Be mindful, that the ingest of logs into a Log Analytics workspace has some Latency, so you may see a delay with the logs displaying.
115
+
Be mindful that the ingestion of logs into a Log Analytics workspace has some latency, so you may see a delay before logs are displayed.
116
116
117
-
Latency refers to the time that data is created on the monitored system and the time that it comes available for analysis in Azure Monitor.
117
+
Latency refers to the time between when data is created on the monitored system and when it becomes available for analysis in Azure Monitor.
118
118
119
-
The [Kusto](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/)Query Language is a tool to explore your data in a Log Analytics Workspace. The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.
119
+
The [Kusto Query Language](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/)(KQL) is a tool to explore your data in a Log Analytics Workspace. The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.
0 commit comments