firewall being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml>sigma
technicques: t1562 t1562.004

Techniques

Identifies when a firewall is created, modified, or deleted.

condition: selection
selection:
  operationName:
  - MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE
  - MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE