{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "slug": "dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed", "url": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/" }, "title": "Keep legacy Azure Firewall logs until structured-log delivery is confirmed", "summary": "Use observed records as the handoff point between logging formats.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:51+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Use this review when changing an existing firewall's log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.", "dse_recommendation": "DSE recommends an explicit logging handoff checklist based on representative records.", "primary_source": { "name": "Monitor Azure Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. Microsoft Learn.

\n

Applicability

\n

Use this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.

\n

DSE recommendation

\n

DSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.

\n

Verification

\n

Generate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.

\n

Official references

\n

Microsoft Learn: Monitor Azure Firewall.

", "content_text": "Source facts\nMicrosoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. Microsoft Learn.\nApplicability\nUse this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.\nDSE recommendation\nDSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.\nVerification\nGenerate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.\nOfficial references\nMicrosoft Learn: Monitor Azure Firewall.", "content_markdown": "## Source facts\n\nMicrosoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall).\n\n## Applicability\n\nUse this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.\n\n## DSE recommendation\n\nDSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.\n\n## Verification\n\nGenerate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.\n\n## Official references\n\n[Microsoft Learn: Monitor Azure Firewall](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "url": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep legacy Azure Firewall logs until structured-log delivery is confirmed", "item": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "url": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/", "headline": "Keep legacy Azure Firewall logs until structured-log delivery is confirmed", "description": "Use observed records as the handoff point between logging formats.", "abstract": "Use observed records as the handoff point between logging formats.", "articleBody": "Source facts\nMicrosoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. Microsoft Learn.\nApplicability\nUse this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.\nDSE recommendation\nDSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.\nVerification\nGenerate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.\nOfficial references\nMicrosoft Learn: Monitor Azure Firewall.", "datePublished": "2026-09-17T16:33:51+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep legacy Azure Firewall logs until structured-log delivery is confirmed" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Monitor Azure Firewall | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall" } } ] } }