# Azure Network Security Analysis

## Network Security Rules

Cartography ingests user-defined and platform-default network security group
rules. Every rule carries the shared `IpRule` label and either
`IpPermissionInbound` or `IpPermissionEgress`, according to its direction.
This allows cross-cloud analysis alongside AWS and GCP network rules.

Inbound allow rules with wildcard internet sources such as `*`, `Internet`, or
`0.0.0.0/0` can expose workloads when their destination ranges cover
management or data-service ports such as 22, 3389, 1433, 3306, 5432, or 6379.
Rule priority, protocol, access, source and destination ranges, and whether a
rule is platform-defined are available as node properties.

## Azure Firewall

Azure Firewall nodes expose the configuration needed for network security
analysis:

- `threat_intel_mode` controls Microsoft threat-intelligence filtering.
- `application_rule_collections` captures layer 7 rules with FQDNs and ports.
- `network_rule_collections` captures layer 4 rules with addresses, protocols,
  and ports.
- `nat_rule_collections` captures destination NAT exposure.
- `ip_groups_detail` captures reusable IP address collections.

Firewall IP configurations connect each firewall to its subnet and public IP.
The private address identifies the internal routing endpoint, while the public
address represents outbound and management connectivity.

## Firewall Policies

Firewall policies expose inherited policy configuration and centralized rule
groups. Important security properties include:

- `threat_intel_mode` and `intrusion_detection_mode`
- `rule_groups_detail`, including network, application, and NAT rules
- `dns_servers` and `dns_enable_proxy`
- `snat_private_ranges`
- `transport_security_ca_name`
- threat-intelligence IP and FQDN allowlists

These properties support analysis of policy inheritance, traffic inspection,
name resolution, source NAT exclusions, and encrypted-traffic inspection.