Ingestion - Get Azure Private endpoint connections from Azure Resources

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Ingestion - Get Azure Private endpoint connections from Azure Resources

L0 Member

Is it possible to ingest private endpoint connections from Azure Resources in resources like SQL Database, App Services, Storage Account and others? I have tried to get this information consulting the Resource Config JSON and I could not find this data.

4 REPLIES 4

L4 Transporter

Greetings MHollanda,

 

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

 

Kind Regards,

J. Avery King

J. Avery King | Prisma Cloud | Customer Success Engineer

Hi J.Avery King,

 

Not sure if MHollanda still needs this information, but I'm certainly interested in finding out the answer! In our Azure Gov environment, we want to route ensure all traffic is routed through the NGFW. The resource in question is the Storage Account that Prisma Cloud uses to extract the NSG flow logs.

 

From the technical documentation, it looks like simply adding the NAT Gateway IP addresses for the Prisma Cloud console via the Azure portal would allow connection to the Storage Account, thereby bypassing the firewall. To solve this, we would like to use a private endpoint on the Storage Account and have the Prisma service principal use that IP for data ingestion.

 

Is this possible, or can you recommend an alternate option for meeting the requirement (all traffic routed through the NGFW)?

 

Thank you!

L0 Member

This is the same situation for me as well. We want to use Azure Private endpoint on the storage account and traffic will pass through the NGFW. But not sure Prisma can provide any solution for that. 

L2 Linker

Azure Private Endpoints were introduced in Prisma Cloud in February 2023. 

 

Sample RQL to check Azure Storage account is not configured with private endpoint connection

config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equals Succeeded and networkRuleSet.defaultAction equal ignore case Allow and networkRuleSet.virtualNetworkRules is empty and networkRuleSet.ipRules[*] is empty and properties.privateEndpointConnections[*] is empty

Paul Burega, CSPM Customer Success Engineer Team Lead

Did you receive a reply that helped solve your question? Share it with others - click the "Accept as Solution" button!
  • 2684 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!