Azure Firewall Policy Deleted

AnalysisType: rule
Filename: azure_firewall_policy_deleted.py
RuleID: "Azure.MonitorActivity.Network.FirewallPolicyDeleted"
DisplayName: "Azure Firewall Policy Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when an Azure Firewall policy is deleted. Firewall policies define critical network security
  rules that control traffic flow and protect resources. Adversaries may delete firewall policies to
  disable network security controls, allow malicious traffic, or enable data exfiltration. This activity
  is a strong indicator of defense evasion or preparation for follow-on attacks.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.004 # Defense Evasion: Impair Defenses - Disable or Modify System Firewall
Tags:
  - Defense Evasion
  - Impair Defenses
  - Disable or Modify System Firewall
Runbook: |
  1. Query Azure Monitor Activity logs for all network security operations (firewall policy changes, NSG deletions, network watcher deletions) by the callerIpAddress in the 24 hours before and after the alert
  2. Find all firewall policy deletions and modifications in the past 6 hours to determine if this is part of a coordinated attack on network security controls
  3. Check if the callerIpAddress has performed similar network security changes in the past 90 days to establish if this is typical operational activity
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/defense_evasion_azure_firewall_policy_deletion.toml
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
  - location
Tests:
  - Name: Firewall Policy Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/network-rg/providers/Microsoft.Network/firewallPolicies/production-firewall-policy",
        "operationName": "MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE",
        "operationVersion": "2021-05-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "level": "Informational",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Firewall Policy Deleted Case Insensitive
    ExpectedResult: true
    Log:
      {
        "time": "2025-12-22T11:15:00.0000000Z",
        "resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/security-rg/providers/Microsoft.Network/firewallPolicies/default-policy",
        "operationName": "microsoft.network/firewallpolicies/delete",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "2.2.2.2",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
        "level": "Information",
        "location": "westeurope",
        "tenantId": "22222222-2222-2222-2222-222222222222"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-12-22T13:00:00.0000000Z",
        "resourceId": "/subscriptions/44444444-4444-4444-4444-444444444444/resourceGroups/network-rg/providers/Microsoft.Network/firewallPolicies/new-policy",
        "operationName": "MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "4.4.4.4",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-456789012345",
        "tenantId": "44444444-4444-4444-4444-444444444444"
      }

# ------ paired body: azure_firewall_policy_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

FIREWALL_POLICY_DELETE_OPERATION = "MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE"


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() == FIREWALL_POLICY_DELETE_OPERATION and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "<UNKNOWN_RESOURCE>")

    policy_name = extract_resource_name_from_id(
        resource_id, "firewallPolicies", default="<UNKNOWN_POLICY>"
    )

    return f"Azure Firewall Policy Deleted: [{policy_name}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    policy_name = extract_resource_name_from_id(resource_id, "firewallPolicies", default="")
    if policy_name:
        context["firewall_policy_name"] = policy_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context