How To Block Malicious Traffic with Azure Firewall and Threat Intelligence

Cyberattacks use harmful IPs, websites, and domains to steal data. Organizations must block this traffic to protect their resources. Azure Firewall Threat Intelligence uses Microsoft’s data to identify threats and can alert administrators, block traffic, or do both, depending on its setup.

Prerequisites

The prerequisites listed here apply to the demonstration described in the article.

A valid Azure Subscription.
Azure Firewall: Basic (supports only alert mode), Standard, and Premium (both support alert and deny modes).
Azure Firewall Policy (with threat intelligence mode alert and deny enabled)
Azure Route Table
Azure VM (Windows 11)

Let’s explore how the threat intelligence features work in Azure Firewall.

My Case Study

In the case study I’m describing, an organization has a large number of Azure VMs, and the executives have requested that the IT department block connections to known malicious destinations because the majority of the VMs are accessed by contractors who work per project.

Since I’ve already deployed the resources I mentioned above, I will show you the key steps to achieve what you requested.

Create a Route Table

The route table sends all outgoing internet traffic from the workload subnet (snet-westeurope-3) to Azure Firewall.

The “default-to-firewall” route sends traffic for 0.0.0.0/0 to the firewall’s private IP address, 192.168.0.4.

This configuration replaces Azure’s default routing, enabling connection checks and logging. It is associated to the snet-westeurop-3 subnet for the deployed Azure VM.

As a result, the rules can find and block harmful traffic before it leaves the network.

Create the Firewall Policy

The firewall policy handles how Azure Firewall manages traffic, including threat intelligence. To do so, open the Firewall Policy “az-fwl-policy”, go to Settings -> Threat Intelligence, select Alert and deny from the drop-down menu, then click Save at the top.

Create the DNAT Rule

Create a DNAT rule in Azure Firewall that allows secure RDP access to the VM and set the source to your public IP address, the destination to the firewall’s public IP (not the management public IP), and the TCP port to 3389. This rule will translate the traffic to the VM’s private IP address on port 3389.

Test the Azure Firewall Threat Intelligence functionality

To test Threat Intelligence, Microsoft has an article that describes how to test Azure Firewall functionality. For inbound testing, I created the DNAT rule I described above, and for outbound testing, Microsoft provides a URL in the article: “testmaliciousdomain.eastus.cloudapp.azure.com”.

Reference: Azure Firewall threat intelligence-based filtering

Check the Azure Firewall Logs

After running several tests on outbound and inbound connections, it’s time to check the log analytics workspace.

Go to the Azure Firewall service and go to Monitoring -> Logs, and run the below KQL Queries, but before you do this, you need to update the way you can explore data from Basic mode to KQL mode.

KQL queries to test and get Azure Firewall logs:

Query 1: This query counts the Azure Firewall logs by category over the past 24 hours.

Query 2: This query retrieves the most recent 20 threat intelligence events related to the firewall.

The Azure Firewall logs display that a user from the test VM at 192.168.2.4 connected to testmaliciousdomain.eastus.cloudapp.azure.com over HTTPS on port 443.
The Azure Firewall raised the alert after matching a Microsoft test indicator and operates in alert-only mode.
The image below depicts exactly what Threat Intelligence feature can do.

Conclusion

Azure Threat Intelligence protects your organization by checking connections against Microsoft’s up-to-date list of harmful IP addresses, domains, and URLs. It automatically identifies compromised workloads and attackers, sending alerts or blocking them without manual updates.
In short, it helps stop traffic linked to known threats and, when used with strong network rules and regular monitoring, adds extra protection for your Azure resources.