Azure integration

Azure Web Application Firewall (WAF) is a cloud-based service from Microsoft Azure that helps protect web applications from common web threats and attacks. It acts as a reverse proxy, inspecting incoming web traffic to your web applications and filtering out malicious requests before they reach your application servers. Traceable integrates with Azure’s WAF to block IP addresses and threat actors.

What will you learn in this topic?

By the end of this topic, you will be able to understand:

• An overview of the steps required to set up the Azure integration.

• The prerequisites for setting up the integration.

• The detailed steps for the integration.

• The management after configuring the integration.

Integration overview

This section provides high-level information on integrating Azure WAF with Traceable and managing threats.

1. Installation — Traceable allows you to choose from an agent-less or agent-based deployment option. For more information on Traceable agents, see Installation.

2. Integration setup — After deploying the agent, you can retrieve the credentials and configure the Azure integration. To do so, you must complete the following steps:

   1. Prerequisites — Log in to your Azure account and retrieve the necessary credentials, including the Azure tenant ID, subscription ID, client ID, and client secret. For more information, see Before you begin.

   2. Integration — After obtaining the credentials from the previous steps, navigate to the Traceable platform and configure the integration. For more information, see Set up the integration.

3. Threat management — After setting up the integration, you can establish rules to allow, block, or monitor IP addresses according to your specific requirements. Traceable's integration with Azure WAF supports the following two types of rules:

   1. Threat Actors — Any status change of threat actor on the Traceable Platform is propagated to Azure WAF. For example, if Traceable detects a threat actor and changes it to a deny state, requests from that threat actor can be blocked in Azure. Traceable recommends going through the allow list conditions before creating any IP-range rules. Traceable allows creating allowlists using allowed and snoozed states, and supports blocking using deny and suspended states under threat actors. For more information, see IP address allowlist. Moreover, if you make any changes, such as adding a threat actor to the allowlist or resolving the status, these changes are reflected in Azure within a few minutes.

   2. Malicious source Rules (IP range only) — If you configure any malicious source rules under Protection → Policies → Custom Policies → Malicious Sources tab to enforce blocking or allow for IP ranges to be executed through Azure.

      Note

      Traceable’s Azure integration does not block IP addresses with x-forwarded-for and x-real-ip headers.

The following is a high-level integration diagram:

Before you begin

Make a note of the following before proceeding with the integration steps:

• Reasonable knowledge of Azure WAF and policies in Azure.

• Tenant ID — In Microsoft Azure, a Tenant ID, also known as a Directory ID or a Directory Tenant ID, is a unique identifier for an Azure Active Directory (Azure AD) tenant. Azure AD is Microsoft's identity and access management service, which manages and secures access to Azure resources. To retrieve the Tenant ID, see Tenant ID.

• Client ID — A Client ID, or an Application ID, is a unique identifier associated with an application or service registered in Azure AD. This Client ID uniquely identifies and authenticates the application when it interacts with Azure AD for various purposes.

• Client Secret — A secret key associated with the Azure app registration, used by Traceable to obtain access tokens and authenticate API requests.

• Azure Subscription ID — A unique identifier for a specific Azure subscription. You can find your Azure Subscription ID in the Azure portal, typically in the subscription section. To retrieve the Tenant ID, see Subscription ID.

• The policies set by Traceable begin with the prefix Traceable.

Set up the integration

To configure a new Azure integration, navigate to the Integrations page from the bottom left corner of your Traceable account, and do one of the following:

• Search for Azure in the search bar.

• Navigate to WAF → Azure WAF.

In the Azure WAF tile, click Configure. In the Add New Azure WAF Integration slide-out panel, complete the following steps:

1. Specify a unique Name for your integration, for example, Azure_WAF.

2. (Optional) Specify a Description summary for your integration, for example, Traceable_integration.

3. Specify the Environments for which you wish to integrate Azure from the drop-down list. These environments could be, for example, production or QA. You can choose one or more environments, or all of them.

4. Specify the Azure Tenant ID, which is a unique identifier associated with your Azure Active Directory tenant. For more information, see Before you begin.

5. Specify the Azure Subscription ID, which is a unique identifier associated with your Azure subscription. For more information, see Before you begin.

6. Specify the Azure environment used for the integration, such as Azure, China, or the US government.

7. Specify the Client ID, which is a unique identifier associated with the registered Azure application. For more information, see Before you begin.

8. Specify the Client Secret, which is a secret key generated during Azure application registration and used for secure authentication.

9. In the Azure Policy Details section, specify the following policy details for Azure:

   

   1. Azure WAF Policy Type — The Azure WAF policy type used for the integration — Front Door ( Global WAF) or Application Gateway ( Regional WAF).

      Policy Name — The policy name associated with the chosen WAF configuration. The available policies are filtered based on the selected policy type.

   2. Resource Group Name — The name of the Azure resource group associated with the selected WAF policy, for example, QA_group.

10. Click Test Connection to test the connection with Azure.

11. Click Save only after a successful test connection.

Note

You can add one or more than one integration for your chosen environment. The same policies are pushed to all the integrations across your chosen environment(s).

To verify the integration, check the rules in your Azure security policy. You can enable sync using the sync now option or schedule a sync in the update section. For more information, see Managed configured integration.

Manage configured integration

After configuring the integration, you can view the Azure WAF Integration under Configured WAF Integrations. Traceable gives you the flexibility to control how the integration operates. You can choose either of the following actions using the drop-down, according to your requirements:

• Enabled — You allow Traceable to actively update the WAF with the latest rules to enforce protection and monitor or block threats. When enabled, Traceable continuously sends new rules and updates to the WAF based on policy activity, helping enforce protections with the latest threat information and block suspicious traffic.

• Disabled — You stop Traceable from updating the WAF, so it no longer enforces new protections for that environment. When disabled, Traceable stops sending new rules and updates to the WAF for the selected environment while other environments continue using their existing integration settings without impact. The WAF continues to enforce existing rules based on their last applied state, without receiving new updates. Traceable continues to detect and evaluate threats, but it does not enforce them through WAF.

Sync Behavior

After you create the integration, you can enable the sync option to push all the WAF rules simultaneously. It helps ensure that Azure WAF remains aligned with the new WAF rules configured in Traceable. The following table explains why you might need the scheduled synchronization or sync now option, when to use it, and how it helps maintain consistent rule enforcement between the platform and Azure WAF:

Synchronization direction — Scheduled Synchronization operates in a single direction from Traceable to Azure WAF. During each synchronization cycle, Traceable pushes the supported rule configuration to Azure WAF to ensure it reflects the latest Traceable state.

Scheduled sync and sync now

Both synchronization options update Azure WAF with supported rules from Traceable, but they serve different purposes.

To enable the sync option, you can choose one of the following options discussed in the table below, according to your requirements:

Configure scheduled sync

To enable Scheduled Sync, complete the following steps:

1. Navigate to the Configured WAF integrations.

2. Click Azure WAF.

3. In the Update Azure WAF Integration slide-out panel, on the Update Integration step, click Next.

4. On the Sync step, enable the Scheduled Sync toggle.

5. Set the synchronization frequency by selecting the Frequency, Day, and Time according to your requirements.

6. Click Save.

After you save the configuration, Traceable automatically runs synchronization according to the schedule you define.