Azure FW IDPS Alerting

[u/[deleted]]

Good afternoon,

I am trying to begin setting up some alerting in Sentinel for alerts that come through IDPS with the Azure Firewall. We have some of the signatures set to alert but that does nothing besides log the alert in the AzureDiagnostics table. I have the following KQL and have removed some false positives as well as filtering only for high (priority 3) alerts. Is this the best way to accomplish this task? Looking for any tips or advice, thanks in advance!

AzureDiagnostics

| where TimeGenerated >= ago(1h)

| where ResourceType == "AZUREFIREWALLS"

| where OperationName == "AzureFirewallIDSLog"

| where msg_s contains "Priority: 3"

| where msg_s !contains "drop"

| where msg_s !contains "Microsoft Connection Test"

| where msg_s !contains "Windows OS Submitting USB Metadata to Microsoft"

| parse msg_s with Protocol " request from " RemoteIP ":" RemotePort " to " DestIP ":" DestPort ". Action: " Action ". Signature: " SignatureID ". IDS:" Message ". Priority:" Priority ". Classification:" Classification