Skip to main content

Palo Alto Networks Application Insights Module for Azure

A Terraform module for deploying a Application Insights in Azure cloud.

Azure AI can be used to gather metric from Palo Alto's VMSeries firewall. This can be done for both a standalone firewall as for a Scale Set deployment.

In both situations the instrumentation key for the Application Insights has to be provided in the firewall's configuration. For more information please refer to documentation.

NOTICE

  • Azure support for classic Application Insights mode will end on Feb 29th 2024. It's already not available in some of the new regions. This module by default deploys Application Insights in Workspace mode.

  • The metrics gathered within a single Azure Application Insights instance provided by the module, cannot be split back to obtain a result for a single firewall. Thus for example if three firewalls use the same Instrumentation Key and report their respective session utilizations as 90%, 20%, 10%, it is possible to see in Azure the average of 40%, the sum of 120%, the max of 90%, but it is not possible to know which of the firewalls reported the 90% utilization.

  • Since upgrade to provider 3.x, when destroying infrastructure a resource is being left behind: microsoft.alertsmanagement/smartdetectoralertrules. This resource is not present in the state nor code, it's being created by Azure automatically and therefore it prevents resource group deletion. A workaround is to set the following provider configuration:

    provider "azurerm" {
    features {
    resource_group {
    prevent_deletion_if_contains_resources = false
    }
    }
    }

GitHub Logo Terraform Logo

Usage

The following snippet deploys Application Insights in Workspace mode, setting the retention to 1 year.

module "ai" {
source = "PaloAltoNetworks/swfw-modules/azurerm//modules/application_insights"

name = "vmseries-ai
metrics_retention_in_days = 365
location = "West US"
resource_group_name = "vmseries-rg"
}

Reference

Requirements

NameVersion
terraform>= 1.2, < 2.0
azurerm~> 3.25

Providers

NameVersion
azurerm~> 3.25

Modules

No modules.

Resources

NameType
azurerm_application_insights.thisresource
azurerm_log_analytics_workspace.thisresource

Inputs

NameDescriptionTypeDefaultRequired
nameName of the Application Insights instance.stringn/ayes
workspace_modeApplication Insights mode. If true (default), the 'Workspace-based' mode is used. With false, the mode is set to legacy 'Classic'.

NOTICE. Azure support for classic Application Insights mode will end on Feb 29th 2024. It's already not available in some of the new regions.
booltrueno
workspace_nameThe name of the Log Analytics workspace. Can be null, in which case a default name is auto-generated.stringnullno
workspace_skuAzure Log Analytics Workspace mode SKU. For more information refer to Microsoft's documentation.string"PerGB2018"no
metrics_retention_in_daysSpecifies the retention period in days. Possible values are 0, 30, 60, 90, 120, 180, 270, 365, 550 or 730. Azure defaults is 90.numbernullno
locationA name of a region in which the resources will be creatied.stringn/ayes
resource_group_nameA name of an existing Resource Group.stringn/ayes
tagsA map of tags assigned to all resources created by this module.map(string){}no

Outputs

NameDescription
metrics_instrumentation_keyThe Instrumentation Key of the created instance of Azure Application Insights.

The instance is unused by default, but is ready to receive custom PAN-OS metrics from the firewalls. To use it, paste this Instrumentation Key into PAN-OS -> Device -> VM-Series -> Azure.
application_insights_idAn Azure ID of the Application Insights resource created by this module.