What Changed

Two Analytic Rules in the Azure Firewall solution (v3.0.7) receive logic fixes:

Analytic Rules (2 updated)

Azure Firewall - Abnormal Port to Protocol

Data source: AZFWNetworkRule (and legacy AzureDiagnostics)

Logic change: One branch of the union used leftouter join followed by where LearningTimeProtocol != AlertTimeProtocol. This caused false positives when the same destination port had multiple protocols during the learning period. The fix replaces this with a leftanti join on both AlertTimeDstPort and AlertTimeProtocol simultaneously, so only port+protocol combinations that were never seen during learning trigger an alert.

Previous behaviour: a port seen in the learning period with protocol TCP would still alert if it later appeared with UDP, even if UDP was also present in the learning window.

SeveralDenyActionsRegistered

Data source: AZFWApplicationRule, AZFWNetworkRule, AZFWFlowTrace, AZFWIdpsSignature, AzureDiagnostics

Logic changes (3):

  1. Broken threshold variable — all five union branches referenced [“threshold”] (a string literal) instead of the threshold variable. The threshold comparison was effectively non-functional; every source IP with at least one deny was alerting. The fix substitutes the correct variable reference (threshold) throughout.

  2. Threshold raised from 1 to 2 — now that the variable is actually evaluated, the rule requires at least 2 deny events before alerting, eliminating single-event noise.

  3. AZFWNetworkRule aggregation improved — the network-rule branch previously counted raw rows per protocol, which produced multiple result rows per source IP (one per protocol). The fix aggregates with dcount(DestinationPort) as the count metric and make_set(Protocol) to collect all protocols, then emits a single combined Protocol string via strcat_array(Protocols, “/”). This prevents duplicate alerts for the same source IP across different protocols.

Detection Impact

Before this fix: Both rules were generating excess false-positive alerts — the deny rule in particular was almost certainly firing on any source IP that received a single deny, regardless of configured threshold. Security teams operating these rules should expect a significant reduction in alert volume after upgrading.

Blind spot assessment: No coverage gap introduced. The logic changes tighten precision without removing detection surface for the underlying TTPs (T1071 — Application Layer Protocol C2; T1210 — Exploitation of Remote Services).

Affected Files

Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml
Solutions/Azure Firewall/Analytic Rules/SeveralDenyActionsRegistered.yaml
(packaging artefacts: 3.0.7.zip, ReleaseNotes.md, Solution_AzureFirewall.json, mainTemplate.json)