azure-firewall-dnat-rule-record

Azure Firewall DNAT rule (classic natRuleCollections model) is ingested as a synthetic Route node encoding (firewall_id, rule_name). The route is linked to the internal destination subnet via RoutesTo edge.

explicit azure emits RoutesTo

source type	`Route`
target type	`Subnet`
source	`<synthetic Route node: firewall_id + rule_name>`
target	`<Subnet containing translatedAddress>`

source type

Route

target type

Subnet

source

<synthetic Route node: firewall_id + rule_name>

target

<Subnet containing translatedAddress>

Azure Firewall {firewall.name} classic DNAT rule forwards {destinationAddresses}:{destinationPorts} -> {translatedAddress}:{translatedPort} to {subnet.name}.

Raw rule rules/explicit/azure-firewall.yaml

id: azure-firewall-dnat-rule-record
emits: RoutesTo
applies_to:
- azure
description: Azure Firewall DNAT rule (classic natRuleCollections model) is ingested as a synthetic Route
  node encoding (firewall_id, rule_name). The route is linked to the internal destination subnet via RoutesTo
  edge.
source_config:
  resource_type: Microsoft.Network/azureFirewalls
  field: properties.natRuleCollections[].rules[]
where:
- properties.natRuleCollections[].rules[].action.type == 'Dnat'
- properties.natRuleCollections[].rules[].translatedAddress is non-null and non-empty
- firewall provisioningState == 'Succeeded'
- translatedAddress is private RFC-1918 IP or resolvable to a Subnet in inventory
emit:
  source_type: Route
  target_type: Subnet
  source: '<synthetic Route node: firewall_id + rule_name>'
  target: <Subnet containing translatedAddress>
  api_source: Microsoft.Network/azureFirewalls GET
  evidence_field: natRuleCollections[].rules[].destinationAddresses + natRuleCollections[].rules[].destinationPorts
    + natRuleCollections[].rules[].translatedAddress + natRuleCollections[].rules[].translatedPort
  properties:
    source: azure_firewall_dnat
    firewall_id: <firewall resource id>
    rule_name: <rule name>
    destination_port: <destinationPorts>
    translated_port: <translatedPort>
    translated_address: <translatedAddress>
  narrative: Azure Firewall {firewall.name} classic DNAT rule forwards {destinationAddresses}:{destinationPorts}
    -> {translatedAddress}:{translatedPort} to {subnet.name}.

azure-firewall-dnat-rule-record

where

emit

Narrative

Raw rule rules/explicit/azure-firewall.yaml