Ingestion - Get Azure Private endpoint connections from Azure Resources

[MHollanda]

Is it possible to ingest private endpoint connections from Azure Resources in resources like SQL Database, App Services, Storage Account and others? I have tried to get this information consulting the Resource Config JSON and I could not find this data.

[AKing9]

Greetings MHollanda,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

[JoeyF]

Hi J.Avery King,

Not sure if MHollanda still needs this information, but I'm certainly interested in finding out the answer! In our Azure Gov environment, we want to route ensure all traffic is routed through the NGFW. The resource in question is the Storage Account that Prisma Cloud uses to extract the NSG flow logs.

From the technical documentation, it looks like simply adding the NAT Gateway IP addresses for the Prisma Cloud console via the Azure portal would allow connection to the Storage Account, thereby bypassing the firewall. To solve this, we would like to use a private endpoint on the Storage Account and have the Prisma service principal use that IP for data ingestion.

Is this possible, or can you recommend an alternate option for meeting the requirement (all traffic routed through the NGFW)?

Thank you!

[Kamrul_Hasan]

This is the same situation for me as well. We want to use Azure Private endpoint on the storage account and traffic will pass through the NGFW. But not sure Prisma can provide any solution for that. 

[PBurega]

Azure Private Endpoints were introduced in Prisma Cloud in February 2023. 

Sample RQL to check Azure Storage account is not configured with private endpoint connection

config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equals Succeeded and networkRuleSet.defaultAction equal ignore case Allow and networkRuleSet.virtualNetworkRules is empty and networkRuleSet.ipRules[*] is empty and properties.privateEndpointConnections[*] is empty