feat(azure): Azure Firewall Support

[ashton-suire]

Summary

This PR adds comprehensive support for Azure Firewall and Azure Firewall Policy resources to Cartography, enabling security teams to analyze firewall configurations, security rules, and network protections across Azure environments.

What Changed:

• New intel module [firewall.py] that fetches Azure Firewalls and Firewall Policies
• Enriches policies with rule collection groups containing actual security rules (ports, protocols, addresses)
• Enriches firewalls with IP Groups for IP address resolution
• Data models for AzureFirewall (33 properties) and AzureFirewallPolicy (39 properties)
• Captures all security-critical data: network rules, application rules, NAT rules, threat intel, IDPS, DNS proxy, TLS inspection
• Test data, demo support, and comprehensive documentation

This implementation allows security teams to:

• Audit network security rules across subscriptions
• Identify exposed services via NAT rules
• Validate security controls (threat intelligence, IDPS)
• Detect misconfigurations and overly permissive rules
• Map attack surface through firewall policies

Files Changed:

New: [firewall.py] (379 lines)
New: [azure_firewall.py](150 lines)
New: [firewall_policy.py] (156 lines)
New: [firewall.py] (239 lines)
Modified: [init.py] [azure.py] [schema.md] [README.md]
Stats: 9 files changed, 1,040 insertions, 1 deletion

Related issues or links

Closes #2215

Checklist

Provide proof that this works (this makes reviews move faster). Please perform one or more of the following:

• Update/add unit or integration tests.
  Added comprehensive test data in [firewall.py] with realistic security rules (SSH port 22, HTTPS port 443, web DNAT, threat intel config, IDPS settings)
• Include a screenshot showing what the graph looked like before and after your changes.

- [x] Include console log trace showing what happened before and after your changes. Before: No Azure Firewall nodes in graph After: Successfully synced real Azure Firewall resources to Neo4j database with all security rules captured

INFO:cartography.intel.azure.firewall:Syncing Azure Firewalls and Firewall Policies
INFO:cartography.graph.statement:Completed AzureFirewall statement #1
INFO:cartography.graph.statement:Completed AzureFirewall statement #2
INFO:cartography.graph.statement:Completed AzureFirewall statement #3
INFO:cartography.graph.statement:Completed AzureFirewall statement #4
INFO:cartography.graph.statement:Completed AzureFirewall statement #5
INFO:cartography.graph.job:Finished job AzureFirewall
INFO:cartography.graph.statement:Completed AzureFirewallPolicy statement #1
INFO:cartography.graph.statement:Completed AzureFirewallPolicy statement #2
INFO:cartography.graph.job:Finished job AzureFirewallPolicy

If you are changing a node or relationship:

• Update the schema and readme.
  Updated [schema.md] with 150+ lines of comprehensive documentation
  Added full property tables for AzureFirewall and AzureFirewallPolicy
  Documented all 6 relationships with Cypher examples
  Added Security Properties sections explaining critical fields
  Updated [README.md] to list "Firewall, Firewall Policy" in Azure module

If you are implementing a new intel module:

• Use the NodeSchema data model.
• Confirm that the linter actually passes (submitting a PR where the linter fails shows reviewers that you did not test your code and will delay your review).

➜  pre-commit run --files cartography/intel/azure/firewall.py cartography/models/azure/firewall/azure_firewall.p
y cartography/models/azure/firewall/firewall_policy.py tests/data/azure/firewall.py cartography/intel/azure/__in
it__.py demo/seeds/azure.py docs/root/modules/azure/schema.md README.md
uv-lock..............................................(no files to check)Skipped
check docstring is first.................................................Passed
check that executables have shebangs.................(no files to check)Skipped
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
check yaml...........................................(no files to check)Skipped
debug statements (python)................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
isort....................................................................Passed
black....................................................................Passed
flake8...................................................................Passed
pyupgrade................................................................Passed
mypy.....................................................................Passed

[cubic-dev-ai]

3 issues found across 9 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="docs/root/modules/azure/schema.md">

<violation number="1" location="docs/root/modules/azure/schema.md:1974">
P2: AzureFirewall relationship to Virtual Hub is documented with a nonexistent node definition and wrong edge label (CONNECTED_VHUB vs actual DEPLOYED_TO), making the schema inaccurate.</violation>
</file>

<file name="cartography/intel/azure/firewall.py">

<violation number="1" location="cartography/intel/azure/firewall.py:34">
P1: Swallowing Azure HttpResponseError returns empty results and still runs cleanup, causing stale deletion on auth/systemic failures</violation>
</file>

<file name="cartography/models/azure/firewall/azure_firewall.py">

<violation number="1" location="cartography/models/azure/firewall/azure_firewall.py:95">
P2: AzureFirewall VNet relationship uses vnet_id but the node never stores or populates vnet_id, so MEMBER_OF edges to AzureVirtualNetwork are never created.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="cartography/intel/azure/firewall.py">

<violation number="1" location="cartography/intel/azure/firewall.py:31">
P2: Docstring not updated to document newly propagated HttpResponseError from Azure list call; callers may be unaware they must handle failures.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[ashton-suire]

Azure Firewall Support

This PR integrates Azure Firewall into Cartography.

What’s included

Ingestion

• Azure sync entry point now calls firewall.sync(...) from cartography/intel/azure/__init__.py.
• 'cartography/intel/azure/firewall.py` gathers firewalls, policies, and IP groups

Nodes:

• AzureFirewall
• AzureFirewallPolicy
• AzureFirewallIPConfiguration

Security-relevant properties captured:

• Threat intelligence mode
• IDPS configuration
• NAT / application / network rules
• IP groups
• DNS / SNAT / explicit proxy / TLS inspection

Relationships:

• (:AzureSubscription)-[:RESOURCE]->(:AzureFirewall|AzureFirewallPolicy|AzureFirewallIPConfiguration)
• (:AzureFirewall)-[:USES_POLICY]->(:AzureFirewallPolicy)
• (:AzureFirewall)-[:MEMBER_OF]->(:AzureVirtualNetwork)
• (:AzureFirewall)-[:DEPLOYED_TO]->(:AzureVirtualHub)
• (:AzureFirewall)-[:HAS_IP_CONFIGURATION]->(:AzureFirewallIPConfiguration)
• (:AzureFirewallIPConfiguration)-[:IN_SUBNET]->(:AzureSubnet)
• (:AzureFirewallIPConfiguration)-[:USES_PUBLIC_IP]->(:AzurePublicIPAddress)

Documentation

• Covers:
  • All three node types
  • Their properties
  • Security implications
  • Relationships with Cypher examples

Demo

• demo/seeds/azure.py:
  • Loads firewall policies first
  • Then firewalls
• Note: IP configurations are not seeded in the demo path yet.

Testing

Unit tests:

• Located in:
  • tests/unit/cartography/intel/azure/test_firewall.py
• Validate:
  • Transform behavior
  • Optional / missing fields
  • Firewall, policy, and IP configuration handling

Integration tests:

• Located in:
  • tests/integration/cartography/intel/azure/test_firewall.py
• Validate:
  • Full sync path
  • All nodes and relationships
  • Cleanup behavior
• Use mocked Azure SDK calls and real-shape fixture data from:
  • tests/data/azure/firewall.py

[kunaals]

nice work on this - the azure firewall implementation looks solid overall. transform functions handle the flat sdk structure correctly, load order is right (policies → firewalls → ip configs), and the test coverage is good.

however there's one issue that needs fixing before this can merge - the firewall policy subscription relationship direction is backwards which will break subscription-scoped queries.