WindowsFirewall

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for WindowsFirewall table in Azure Monitor Logs.

Attribute Value
Category Windows
Basic Logs Eligible ✗ No (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Azure Monitor Tables Reference View Documentation

Contents

Schema (32 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
_ResourceId string A unique identifier for the resource that the record is associated with
_SubscriptionId string A unique identifier for the subscription that the record is associated with
CommunicationDirection string
Computer string
Confidence string
Description string
DestinationIP string
DestinationPort int
FirewallAction string
FirstReportedDateTime string
FullDestinationAddress string
IndicatorThreatType string
Info string
IsActive string
LastReportedDateTime string
MaliciousIP string
MaliciousIPCountry string
MaliciousIPLatitude real
MaliciousIPLongitude real
ManagementGroupName string
Protocol string
RemoteIP string
RequestSizeInBytes long
Severity int
SourceIP string
SourcePort int
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TimeGenerated datetime
TLPLevel string
Type string The name of the table

Solutions (6)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Windows Firewall

Content Items Using This Table (6)

Workbooks (6)

In solution ContinuousDiagnostics&Mitigation:

Workbook Selection Criteria
ContinuousDiagnostics&Mitigation

In solution MaturityModelForEventLogManagementM2131:

Workbook Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution NISTSP80053:

Workbook Selection Criteria
NISTSP80053

In solution SOC Handbook:

Workbook Selection Criteria
SecurityStatus

In solution Windows Firewall: DestinationPort == "3389"
FirewallAction in "ALLOW,DROP"
SourceIP !in "::1,-"

Workbook
WindowsFirewall

In solution ZeroTrust(TIC3.0):

Workbook Selection Criteria
ZeroTrustTIC3

Resource Types

This table collects data from the following Azure resource types:

Selection Criteria Summary (1 criteria, 1 total references)

References by type: 0 connectors, 1 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
DestinationPort == "3389"
FirewallAction in "ALLOW,DROP"
SourceIP !in "::1,-"		 - 1 - - 1
Total 0 1 0 0 1

DestinationPort

Value Connectors Content Items ASIM Parsers Other Parsers Total
3389 - 1 - - 1

FirewallAction

Value Connectors Content Items ASIM Parsers Other Parsers Total
ALLOW - 1 - - 1
DROP - 1 - - 1

SourceIP

Value Connectors Content Items ASIM Parsers Other Parsers Total
!= ::1 - 1 - - 1
!= - - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index