# Threat intelligence is Enabled in Deny Mode on Azure Firewall
Azure Firewall threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses, fully qualified domain names…
Source: https://maester.dev/docs/tests/ZTA.25537
## Overview
Azure Firewall threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When you don't enable threat intelligence in `Alert and deny` mode, Azure Firewall doesn't actively block traffic to known malicious destinations.
If you don't enable threat intelligence in `Alert and deny` mode:
- Threat actors can communicate with known malicious infrastructure, enabling data exfiltration and command-and-control communication without active blocking.
- Organizations that use `Alert only` mode can see threat activity in logs but can't prevent connections to known bad destinations.
- All firewall policy tiers remain exposed to threats that the Microsoft Threat Intelligence feed already identified.
## Remediation
- [Configure threat intelligence settings in Azure Firewall Manager](https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to set the threat intelligence mode to `Alert and deny` in the firewall policy.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Infrastructure hardening |
| ATT&CK | [T1071](/docs/tests?mitre=T1071) Application Layer Protocol, [T1041](/docs/tests?mitre=T1041) Exfiltration Over C2 Channel |
| Licence | Azure_Firewall_Standard, Azure_Firewall_Premium |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.