DenyIntelMode for Azure Firewalls is not set to Deny misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_216
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule is checking whether the 'DenyIntelMode' is set to 'Deny' for Azure Firewalls. In an Azure environment, network security is paramount to protect against unauthorized access or security breaches. The 'DenyIntelMode' is a setting in Azure Firewalls which controls network traffic by filtering it against known threat intelligence-based filtering rules. If this setting is not set to 'Deny', it means that the firewall would not block network traffic from malicious IP addresses and domains, potentially introducing serious security risks such as data breaches, DDoS attacks, etc. Therefore, not having 'DenyIntelMode' set to 'Deny' is considered bad and non-compliant with best security practices.

How to Fix

Resource: azurerm_firewall

• Arguments: threat_intel_mode

To fix the issue, you should set the threat_intel_mode attribute to Deny for Azure Firewalls. [source,go]

resource "azurerm_firewall_policy" "example" { name = "example" ... threat_intel_mode = "Deny" }