Threat intelligence is Enabled in Deny Mode on Azure Firewall

Overview

Azure Firewall threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When you don’t enable threat intelligence in Alert and deny mode, Azure Firewall doesn’t actively block traffic to known malicious destinations.

If you don’t enable threat intelligence in Alert and deny mode:

• Threat actors can communicate with known malicious infrastructure, enabling data exfiltration and command-and-control communication without active blocking.
• Organizations that use Alert only mode can see threat activity in logs but can’t prevent connections to known bad destinations.
• All firewall policy tiers remain exposed to threats that the Microsoft Threat Intelligence feed already identified.

Remediation

• Configure threat intelligence settings in Azure Firewall Manager to set the threat intelligence mode to Alert and deny in the firewall policy.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1071 Application Layer Protocol, T1041 Exfiltration Over C2 Channel
Licence	Azure_Firewall_Standard, Azure_Firewall_Premium
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.