PerAppFirewallRule
Per-Application Firewall Rule Discovery & NSG Export Module
What it does
Builds a per-application view of firewall / Network Security Group (NSG) rules by joining NSG rule exports against application-to-host mappings. Closes the competitive gap vs Cloudamize, which presents firewall posture per workload rather than per subnet. Also produces a normalized NSG rule export suitable for re-applying to a target Azure environment during migration cutover. Input sources (auto-detected, all are optional - module degrades gracefully): Firewall / NSG rules (first match wins): 1. NSGRules.csv (Azure NSG rule export) 2. NetworkSecurityGroups.csv (legacy NSG dump) 3. FirewallRules.csv (generic firewall rule export) 4. PaloAltoRules.csv (Palo Alto export from PaloAltoDiscovery) Application-to-host mapping (first match wins): 1. ApplicationDependencyDiscovery.csv (Application,Host,IPAddress) 2. Applications.csv (Application,Servers/Hosts) 3. AzureVMs.csv (VM,IPAddress,Subnet,NSG) 4. ComputerInventory.csv (Hostname,IPAddress,ApplicationOwner) Output: PerAppFirewallRules.csv with columns: ApplicationName, ApplicationId, HostName, HostIP, RuleName, Direction, Priority, SourceAddress, SourcePort, DestAddress, DestPort, Protocol, Action, NSGName, ScopeType, MatchConfidence NSGRulesExport.csv (Azure-importable, deduplicated): NSGName, RuleName, Direction, Priority, SourceAddress, SourcePort, DestAddress, DestPort, Protocol, Action, Description PerAppFirewallRuleDiscovery.json (summary) Enriched: ConvertFrom-FirewallRule normalizes rule objects into a standard schema, ConvertFrom-ApplicationHost converts app rows into app-host mappings, and Test-RuleMatchesHost determines rule-to-application affinity with confidence scoring.
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/per-app-firewall-rule Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.