Azure Firewalls inspecting no traffic on any of three axes
What does ZopNight detect here?
Azure Firewall costs roughly $900+ per month at a flat hourly rate, so ZopNight checks three 30-day series (DataProcessed under 1 MB, NetworkRuleHit under 1, ApplicationRuleHit under 1) and flags the firewall only when all three are silent. A perimeter appliance gets the most abstain-biased treatment in the ruleset.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1365 |
| Category | idle |
| Severity | critical |
| Metric | none — pure configuration read |
| Source | firewall_idle.go |
Where it applies
A $900 appliance deserves three locks
Azure Firewall is both expensive and dangerous to remove: the SKU bills a flat hourly rate
(roughly $900+ a month before data charges) and a wrong delete tears down a network perimeter.
ZopNight treats it accordingly. Before the finding fires, three independent Azure Monitor axes must all be quiet:
DataProcessed for bytes flowing through, NetworkRuleHit for L4 rule matches, and
ApplicationRuleHit for L7 FQDN/HTTP filtering. Partial evidence is
never enough; a missing series on any axis means abstain, not fire.
Floors tuned to platform noise
A firewall in a live perimeter emits a tiny baseline with no real workload: keepalives, health probes, DNS-proxy housekeeping. The floors are sized to admit only that baseline: 1,000,000 bytes (1 MB) averaged on the data axis, single-digit counts (floor of 1) on each rule-hit axis. Real perimeter traffic runs megabytes per second and thousands of hits, so anything at or above a floor, including one Maximum spike, vetoes the finding.
Thirty days on every axis, not seven
Cheaper idle rules accept a 7-day history floor. This one demands the full 30 days of coverage on all three series, because a freshly deployed firewall showing zeros proves only that monitoring just started. The blast radius of a false positive justifies the longer wait.
Verify all three axes at once
az monitor metrics list \ --resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/azureFirewalls/<name>" \ --metric DataProcessed NetworkRuleHit ApplicationRuleHit \ --interval PT1H --offset 30d --aggregation Average MaximumScheduling instead of deleting
For a dev/test perimeter, the cheaper-than-delete option is deallocating the firewall
off-hours. Azure Firewall Manager is a policy service and does not offer start/stop
scheduling, so the working pattern is an Automation runbook calling the PowerShell
Deallocate() and Allocate() methods on the firewall object.
The abstain list
No fire when any of the three series is absent, any axis has under 30 days of data, any axis reads at or above its floor, or the SKU cost is unpriced. Detection needs Reader plus Monitoring Reader; nothing in ZopNight holds a write permission on Azure Firewall.