Monitor Web Application Firewall setting is not enabled

More Info:

Enable Web Application Firewall recommendations for virtual machines.

Risk Level

Low

Address

Operational Maturity, Security

Compliance Standards

• HIPAA
• HITRUST CSF
• ISO 27001
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the “Monitor Web Application Firewall setting is not enabled” misconfiguration in Azure using the Azure console, you can follow the below steps:

1. Open the Azure portal and navigate to the Azure Application Gateway resource that you want to configure.
2. Click on the “Firewall” option under the “Security” section in the left-hand menu.
3. Under the “Web application firewall” section, click on the “Edit” button.
4. In the “Web application firewall settings” page, scroll down to the “Diagnostic logs” section.
5. Click on the “Enable” button next to “Send logs to Log Analytics workspace”.
6. Select the Log Analytics workspace that you want to use for storing the diagnostic logs.
7. Click on the “Save” button to save the changes.

Once you have completed these steps, the “Monitor Web Application Firewall setting is not enabled” misconfiguration will be remediated and the diagnostic logs for the web application firewall will be sent to the specified Log Analytics workspace for monitoring and analysis.

Using CLI

To remediate the “Monitor Web Application Firewall setting is not enabled” misconfiguration in Azure using Azure CLI, please follow the below steps:

1. Open the Azure CLI command prompt and log in to your Azure account using the command: az login

2. Once you are logged in, set your subscription using the command: az account set --subscription <subscription_id>

3. Enable the Web Application Firewall (WAF) monitoring by running the following command: az network application-gateway waf-policy set --name <waf_policy_name> --resource-group <resource_group_name> --firewall-mode Detection

   Note: Replace <waf_policy_name> and <resource_group_name> with the actual names of your WAF policy and resource group.

4. Verify that the WAF monitoring is enabled by running the following command: az network application-gateway waf-policy show --name <waf_policy_name> --resource-group <resource_group_name>

   This command will display the details of your WAF policy, including the firewall mode which should now be set to “Detection”.

5. Finally, you can also verify the WAF monitoring status by checking the Azure Security Center dashboard.

By following these steps, you should be able to remediate the “Monitor Web Application Firewall setting is not enabled” misconfiguration in Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Monitor Web Application Firewall setting is not enabled” for Azure using Python, follow the below steps:

Step 1: Import the required libraries

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.monitor import MonitorManagementClient

Step 2: Authenticate and create the MonitorManagementClient object

TENANT_ID = '<your tenant id>'
CLIENT = '<your client id>'
KEY = '<your client secret>'
SUBSCRIPTION_ID = '<your subscription id>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT,
    secret=KEY,
    tenant=TENANT_ID
)

monitor_client = MonitorManagementClient(
    credentials,
    SUBSCRIPTION_ID
)

Step 3: Retrieve the existing web application firewall settings

resource_id = '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/frontDoors/{2}/webApplicationFirewallConfiguration'.format(
    SUBSCRIPTION_ID,
    '<your resource group name>',
    '<your front door name>'
)

waf_settings = monitor_client.metric_definitions.list(resource_id)

Step 4: Check if the “Monitor Web Application Firewall setting” metric is enabled

waf_metric_name = 'Monitor Web Application Firewall setting'
is_enabled = False

for metric in waf_settings:
    if metric.name.localized_value == waf_metric_name:
        is_enabled = True
        break

Step 5: If the metric is not enabled, enable it

if not is_enabled:
    monitor_client.metric_baseline.create(
        resource_id,
        waf_metric_name,
        {
            'enabled': True
        }
    )

The above steps will enable the “Monitor Web Application Firewall setting” metric for your Azure front door using Python.

Using Terraform

data "azurerm_client_config" "current" {}

resource "azurerm_policy_assignment" "asc_default" {
  name                 = "ASC-DEFAULT-POLICY-ASSIGNMENT" # replace with desired assignment name
  display_name         = "Azure Security Center default policy (includes WAF monitoring)"
  description          = "Enables Azure Security Center (Defender for Cloud) default policy initiative, including Monitor Web Application Firewall."
  scope                = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/ASCDefault"

  enforcement_mode = "Default"

  # Optional: assign to a specific resource group instead of whole subscription
  # scope = "/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/RESOURCE_GROUP_NAME"
}

This does not normally force replacement of other resources; if you already have a different policy assignment with the same name, Terraform will replace that assignment.

Verification: terraform plan should show an azurerm_policy_assignment.asc_default to be created (or updated) with policy_definition_id set to /providers/Microsoft.Authorization/policySetDefinitions/ASCDefault at the desired scope.