🔥 Azure Firewall Watch

Azure Firewall Watch is a terminal UI for live log monitoring of Azure Firewall. It streams logs from an Event Hub in real time and lets you filter and inspect them directly in your terminal. With read access to Azure Resource Manager it also shows the firewall's policy and IP groups, and explains which rule a log row matched.

Built by CloudChristoph.

This project is based on the excellent work by Nicola Delfino and his azure-firewall-mon project.

• Live log stream from an Event Hub: structured and legacy log formats, every category from NetworkRule to FatFlow, with automatic reconnect.
• Instant filters on source, destination, action, category, protocol and port, CIDR prefixes included, plus one-click presets that separate decisions from observations and DNS noise.
• Dual-stack firewalls: IPv6 addresses in every log category the preview emits them for, in the table, the detail dialog, the filters and the evaluation trace.
• Policy context: Firewall, Policy and IP Groups tabs built from Azure Resource Manager, with log rows enriched by what the policy says.
• Evaluation trace: press Enter on a row to see the path that flow took through the policy, collection by collection, up to the rule that matched.
• Setup wizard that finds or deploys the Event Hub, wires up Diagnostic Settings and writes your .env.
• Single binary for Windows, macOS and Linux, with no Python install required.

The trace is computed against your real policy, so it also works the other way round: on a Deny · no rule matched row it walks the whole path and names the criterion that kept each near miss out, down to port: 8443 not in 443. That is usually faster than reading the policy yourself. → Policy context

The viewer reads from two independent sources. Only the first one is required:

flowchart LR
    subgraph azure["Azure"]
        direction LR
        FW["🔥 Azure Firewall"]
        DS["Diagnostic Settings"]
        EH[("Event Hub")]
        ARM["Azure Resource Manager<br/>policy · IP groups"]
        FW --> DS --> EH
        FW -.- ARM
    end

    EH ==>|"live logs<br/>required"| APP["az-firewall-watch"]
    ARM -.->|"policy context<br/>optional, read-only"| APP

    classDef optional stroke-dasharray: 4 3
    class ARM optional

1. Diagnostic Settings on your Azure Firewall forward the log categories to an Event Hub namespace, which buffers them so the viewer can consume them live. → Event Hub and diagnostic settings

2. Azure Resource Manager is read on demand for the firewall, its policy and the referenced IP groups. This is what powers the extra tabs and the evaluation trace, it is strictly read-only, and it can be switched off entirely. → Policy context

Download the binary for your platform from the latest release and run it. The setup wizard starts automatically on first launch:

# macOS / Linux
tar -xzf az-firewall-watch-linux.tar.gz
./az-firewall-watch

# Windows
.\az-firewall-watch.exe

Or run from source (Python 3.10+):

git clone https://github.com/cloudchristoph/az-firewall-watch.git
cd az-firewall-watch
./start.sh          # Windows: start.bat

Platform notes (Gatekeeper, SmartScreen) and the full wizard walkthrough are in Getting started.

MIT. See LICENSE.