topic Re: Ingestion - Get Azure Private endpoint connections from Azure Resources in Prisma Cloud Discussions

Ingestion - Get Azure Private endpoint connections from Azure Resources

MHollanda — Mon, 03 May 2021 23:03:22 GMT

Is it possible to ingest private endpoint connections from Azure Resources in resources like SQL Database, App Services, Storage Account and others? I have tried to get this information consulting the Resource Config JSON and I could not find this data.

Re: Ingestion - Get Azure Private endpoint connections from Azure Resources

AKing9 — Fri, 12 Aug 2022 14:21:37 GMT

Greetings MHollanda,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

Re: Ingestion - Get Azure Private endpoint connections from Azure Resources

JoeyF — Tue, 25 Jul 2023 00:52:11 GMT

Hi J.Avery King,

Not sure if MHollanda still needs this information, but I'm certainly interested in finding out the answer! In our Azure Gov environment, we want to route ensure all traffic is routed through the NGFW. The resource in question is the Storage Account that Prisma Cloud uses to extract the NSG flow logs.

From the technical documentation, it looks like simply adding the NAT Gateway IP addresses for the Prisma Cloud console via the Azure portal would allow connection to the Storage Account, thereby bypassing the firewall. To solve this, we would like to use a private endpoint on the Storage Account and have the Prisma service principal use that IP for data ingestion.

Is this possible, or can you recommend an alternate option for meeting the requirement (all traffic routed through the NGFW)?

Thank you!

Re: Ingestion - Get Azure Private endpoint connections from Azure Resources

Kamrul_Hasan — Mon, 10 Jun 2024 16:16:04 GMT

This is the same situation for me as well. We want to use Azure Private endpoint on the storage account and traffic will pass through the NGFW. But not sure Prisma can provide any solution for that.

Re: Ingestion - Get Azure Private endpoint connections from Azure Resources

PBurega — Fri, 28 Jun 2024 15:05:01 GMT

Azure Private Endpoints were introduced in Prisma Cloud in February 2023.

Sample RQL to check Azure Storage account is not configured with private endpoint connection

config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equals Succeeded and networkRuleSet.defaultAction equal ignore case Allow and networkRuleSet.virtualNetworkRules is empty and networkRuleSet.ipRules[*] is empty and properties.privateEndpointConnections[*] is empty