Repository: Azure/azure-cli-extensions

Issue:
Azure Firewall: add threat intel mode
**Extension name (the extension in question)**
azure-firewall

**Resource Provider**
`Microsoft.Network`

**Description of Feature or Work Requested**
Add parameter to set mode of Threat Intelligence (three modes: `Alert`, `Deny`, `Off`)

**Minimum API Version Required**
2018-12-01

**Swagger Link**
https://github.com/Azure/azure-rest-api-specs/pull/5143

**Target Date**
No specific target date





Discussion:
Sorry. I just saw this issue. I will take a look at it recently.
add to S171

Resolving patch:
diff --git a/src/azure-firewall/azext_firewall/_params.py b/src/azure-firewall/azext_firewall/_params.py
--- a/src/azure-firewall/azext_firewall/_params.py
+++ b/src/azure-firewall/azext_firewall/_params.py
@@ -57,6 +57,7 @@ def load_arguments(self, _):
                                                                                   'The default sku in server end is AZFW_VNet. '
                                                                                   'If you want to attach azure firewall to vhub, you should set sku to AZFW_Hub.')
         c.argument('private_ranges', nargs='+', validator=process_private_ranges, help='Space-separated list of SNAT private range. Validate values are single Ip, Ip prefixes or a single special value "IANAPrivateRanges"')
+        c.argument('threat_intel_mode', arg_type=get_enum_type(['Alert', 'Deny', 'Off']), help='The operation mode for Threat Intelligence.')
 
     with self.argument_context('network firewall', arg_group='DNS') as c:
         c.argument('dns_servers', nargs='+', help='Space-separated list of DNS server IP addresses')
diff --git a/src/azure-firewall/azext_firewall/custom.py b/src/azure-firewall/azext_firewall/custom.py
--- a/src/azure-firewall/azext_firewall/custom.py
+++ b/src/azure-firewall/azext_firewall/custom.py
@@ -66,7 +66,8 @@ def _find_item_at_path(instance, path):
 def create_azure_firewall(cmd, resource_group_name, azure_firewall_name, location=None,
                           tags=None, zones=None, private_ranges=None, firewall_policy=None,
                           virtual_hub=None, sku=None,
-                          dns_servers=None, enable_dns_proxy=None, require_dns_proxy_for_network_rules=None):
+                          dns_servers=None, enable_dns_proxy=None, require_dns_proxy_for_network_rules=None,
+                          threat_intel_mode=None):
     client = network_client_factory(cmd.cli_ctx).azure_firewalls
     AzureFirewall, SubResource, AzureFirewallSku = cmd.get_models('AzureFirewall', 'SubResource', 'AzureFirewallSku')
     sku_instance = AzureFirewallSku(name=sku, tier='Standard')
@@ -76,7 +77,8 @@ def create_azure_firewall(cmd, resource_group_name, azure_firewall_name, locatio
                              additional_properties={},
                              virtual_hub=SubResource(id=virtual_hub) if virtual_hub is not None else None,
                              firewall_policy=SubResource(id=firewall_policy) if firewall_policy is not None else None,
-                             sku=sku_instance if sku is not None else None)
+                             sku=sku_instance if sku is not None else None,
+                             threat_intel_mode=threat_intel_mode)
     if private_ranges is not None:
         if firewall.additional_properties is None:
             firewall.additional_properties = {}
@@ -92,7 +94,8 @@ def create_azure_firewall(cmd, resource_group_name, azure_firewall_name, locatio
 
 def update_azure_firewall(cmd, instance, tags=None, zones=None, private_ranges=None,
                           firewall_policy=None, virtual_hub=None,
-                          dns_servers=None, enable_dns_proxy=None, require_dns_proxy_for_network_rules=None):
+                          dns_servers=None, enable_dns_proxy=None, require_dns_proxy_for_network_rules=None,
+                          threat_intel_mode=None):
     SubResource = cmd.get_models('SubResource')
     if tags is not None:
         instance.tags = tags
@@ -116,7 +119,8 @@ def update_azure_firewall(cmd, instance, tags=None, zones=None, private_ranges=N
         instance.additional_properties['DNSRequireProxyForNetworkRules'] = require_dns_proxy_for_network_rules
     if dns_servers is not None:
         instance.additional_properties['DNSServer'] = dns_servers
-
+    if threat_intel_mode is not None:
+        instance.threat_intel_mode = threat_intel_mode
     return instance
 
 


Test patch:
diff --git a/src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall.yaml b/src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall.yaml
--- a/src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall.yaml
+++ b/src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall.yaml
@@ -11,26 +11,26 @@ interactions:
       Connection:
       - keep-alive
       ParameterSetName:
-      - -g -n
+      - -g -n --threat-intel-mode
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-resource/6.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-resource/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
       accept-language:
       - en-US
     method: GET
     uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_azure_firewall000001?api-version=2019-07-01
   response:
     body:
-      string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001","name":"cli_test_azure_firewall000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","date":"2020-01-15T14:07:06Z"},"properties":{"provisioningState":"Succeeded"}}'
+      string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001","name":"cli_test_azure_firewall000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","date":"2020-06-11T03:36:29Z","StorageType":"Standard_LRS","type":"test"},"properties":{"provisioningState":"Succeeded"}}'
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '428'
+      - '471'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:14 GMT
+      - Thu, 11 Jun 2020 03:36:33 GMT
       expires:
       - '-1'
       pragma:
@@ -45,7 +45,9 @@ interactions:
       code: 200
       message: OK
 - request:
-    body: '{"location": "westus", "properties": {"additionalProperties": {}}}'
+    body: '{"location": "westus", "properties": {"threatIntelMode": "Alert", "additionalProperties":
+      {"DNSEnableProxy": "False", "DNSRequireProxyForNetworkRules": "True", "DNSServer":
+      null}}}'
     headers:
       Accept:
       - application/json
@@ -56,14 +58,14 @@ interactions:
       Connection:
       - keep-alive
       Content-Length:
-      - '66'
+      - '180'
       Content-Type:
       - application/json; charset=utf-8
       ParameterSetName:
-      - -g -n
+      - -g -n --threat-intel-mode
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
       accept-language:
       - en-US
     method: PUT
@@ -71,24 +73,28 @@ interactions:
   response:
     body:
       string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
-        \ \"etag\": \"W/\\\"0a296bbc-aed9-4f08-bdf4-927e98c35c1d\\\"\",\r\n  \"type\":
+        \ \"etag\": \"W/\\\"5f396db0-1b52-4165-b7af-34767d06e43b\\\"\",\r\n  \"type\":
         \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
         {\r\n    \"provisioningState\": \"Updating\",\r\n    \"sku\": {\r\n      \"name\":
         \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
-        \"Alert\",\r\n    \"additionalProperties\": {},\r\n    \"ipConfigurations\":
-        [],\r\n    \"networkRuleCollections\": [],\r\n    \"applicationRuleCollections\":
-        [],\r\n    \"natRuleCollections\": []\r\n  }\r\n}"
+        \"Alert\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
     headers:
+      azure-asyncnotification:
+      - Enabled
       azure-asyncoperation:
-      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/705f363f-0b6c-4674-b046-7657db932b68?api-version=2019-11-01
+      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/0ba7702a-649c-4a96-ac0e-4b913717455a?api-version=2019-11-01
       cache-control:
       - no-cache
       content-length:
-      - '690'
+      - '804'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:19 GMT
+      - Thu, 11 Jun 2020 03:36:38 GMT
       expires:
       - '-1'
       pragma:
@@ -101,9 +107,9 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - b29f9360-78c6-49a5-90c9-78e5ade5a1d2
+      - 92b7607b-875c-41c7-a013-069ae3821d64
       x-ms-ratelimit-remaining-subscription-writes:
-      - '1199'
+      - '1198'
     status:
       code: 201
       message: Created
@@ -119,12 +125,12 @@ interactions:
       Connection:
       - keep-alive
       ParameterSetName:
-      - -g -n
+      - -g -n --threat-intel-mode
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/705f363f-0b6c-4674-b046-7657db932b68?api-version=2019-11-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/0ba7702a-649c-4a96-ac0e-4b913717455a?api-version=2019-11-01
   response:
     body:
       string: "{\r\n  \"status\": \"Succeeded\"\r\n}"
@@ -136,7 +142,7 @@ interactions:
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:30 GMT
+      - Thu, 11 Jun 2020 03:36:50 GMT
       expires:
       - '-1'
       pragma:
@@ -153,7 +159,7 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 1d040669-8e8f-4908-a6c0-27e191843bc7
+      - 0f1a4fc8-2f16-415b-b8c8-d5ec9adac8dd
     status:
       code: 200
       message: OK
@@ -169,33 +175,283 @@ interactions:
       Connection:
       - keep-alive
       ParameterSetName:
-      - -g -n
+      - -g -n --threat-intel-mode
+      User-Agent:
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
+    method: GET
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1?api-version=2019-11-01
+  response:
+    body:
+      string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
+        \ \"etag\": \"W/\\\"7ba67870-21e5-4a28-a158-01cff546b5ff\\\"\",\r\n  \"type\":
+        \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
+        {\r\n    \"provisioningState\": \"Succeeded\",\r\n    \"sku\": {\r\n      \"name\":
+        \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
+        \"Alert\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
+    headers:
+      cache-control:
+      - no-cache
+      content-length:
+      - '805'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 11 Jun 2020 03:36:50 GMT
+      etag:
+      - W/"7ba67870-21e5-4a28-a158-01cff546b5ff"
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      server:
+      - Microsoft-HTTPAPI/2.0
+      - Microsoft-HTTPAPI/2.0
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      transfer-encoding:
+      - chunked
+      vary:
+      - Accept-Encoding
+      x-content-type-options:
+      - nosniff
+      x-ms-arm-service-request-id:
+      - 14796ff6-0165-43b5-a0e9-603b17009691
+    status:
+      code: 200
+      message: OK
+- request:
+    body: null
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - network firewall update
+      Connection:
+      - keep-alive
+      ParameterSetName:
+      - -g -n --threat-intel-mode
+      User-Agent:
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
+      accept-language:
+      - en-US
+    method: GET
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1?api-version=2019-11-01
+  response:
+    body:
+      string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
+        \ \"etag\": \"W/\\\"7ba67870-21e5-4a28-a158-01cff546b5ff\\\"\",\r\n  \"type\":
+        \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
+        {\r\n    \"provisioningState\": \"Succeeded\",\r\n    \"sku\": {\r\n      \"name\":
+        \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
+        \"Alert\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
+    headers:
+      cache-control:
+      - no-cache
+      content-length:
+      - '805'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 11 Jun 2020 03:36:51 GMT
+      etag:
+      - W/"7ba67870-21e5-4a28-a158-01cff546b5ff"
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      server:
+      - Microsoft-HTTPAPI/2.0
+      - Microsoft-HTTPAPI/2.0
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      transfer-encoding:
+      - chunked
+      vary:
+      - Accept-Encoding
+      x-content-type-options:
+      - nosniff
+      x-ms-arm-service-request-id:
+      - 1cbc29d3-7fd6-43ba-8709-12f16a2446bf
+    status:
+      code: 200
+      message: OK
+- request:
+    body: 'b''{"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1",
+      "location": "westus", "properties": {"applicationRuleCollections": [], "natRuleCollections":
+      [], "networkRuleCollections": [], "ipConfigurations": [], "threatIntelMode":
+      "Deny", "sku": {"name": "AZFW_VNet", "tier": "Standard"}, "additionalProperties":
+      {"DNSEnableProxy": "False", "DNSRequireProxyForNetworkRules": "True", "DNSServer":
+      null}}}'''
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - network firewall update
+      Connection:
+      - keep-alive
+      Content-Length:
+      - '542'
+      Content-Type:
+      - application/json; charset=utf-8
+      ParameterSetName:
+      - -g -n --threat-intel-mode
+      User-Agent:
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
+      accept-language:
+      - en-US
+    method: PUT
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1?api-version=2019-11-01
+  response:
+    body:
+      string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
+        \ \"etag\": \"W/\\\"3ddec821-32d9-4d7b-9dd8-0025c1173163\\\"\",\r\n  \"type\":
+        \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
+        {\r\n    \"provisioningState\": \"Updating\",\r\n    \"sku\": {\r\n      \"name\":
+        \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
+        \"Deny\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
+    headers:
+      azure-asyncoperation:
+      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/31a34565-0eae-480a-94ff-90f2072d0d66?api-version=2019-11-01
+      cache-control:
+      - no-cache
+      content-length:
+      - '803'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 11 Jun 2020 03:36:52 GMT
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      server:
+      - Microsoft-HTTPAPI/2.0
+      - Microsoft-HTTPAPI/2.0
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      transfer-encoding:
+      - chunked
+      vary:
+      - Accept-Encoding
+      x-content-type-options:
+      - nosniff
+      x-ms-arm-service-request-id:
+      - 27c73bc9-bac6-4899-890e-707bbc6e7eae
+      x-ms-ratelimit-remaining-subscription-writes:
+      - '1197'
+    status:
+      code: 200
+      message: OK
+- request:
+    body: null
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - network firewall update
+      Connection:
+      - keep-alive
+      ParameterSetName:
+      - -g -n --threat-intel-mode
+      User-Agent:
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
+    method: GET
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/31a34565-0eae-480a-94ff-90f2072d0d66?api-version=2019-11-01
+  response:
+    body:
+      string: "{\r\n  \"status\": \"Succeeded\"\r\n}"
+    headers:
+      cache-control:
+      - no-cache
+      content-length:
+      - '29'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 11 Jun 2020 03:37:04 GMT
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      server:
+      - Microsoft-HTTPAPI/2.0
+      - Microsoft-HTTPAPI/2.0
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      transfer-encoding:
+      - chunked
+      vary:
+      - Accept-Encoding
+      x-content-type-options:
+      - nosniff
+      x-ms-arm-service-request-id:
+      - 51967fb7-923f-42ba-bab9-36602c35d150
+    status:
+      code: 200
+      message: OK
+- request:
+    body: null
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - network firewall update
+      Connection:
+      - keep-alive
+      ParameterSetName:
+      - -g -n --threat-intel-mode
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
     method: GET
     uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1?api-version=2019-11-01
   response:
     body:
       string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
-        \ \"etag\": \"W/\\\"31934919-2cf3-4ac3-bef2-3226134baf4b\\\"\",\r\n  \"type\":
+        \ \"etag\": \"W/\\\"9ee01743-5b07-43b1-8542-68af9b334981\\\"\",\r\n  \"type\":
         \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
         {\r\n    \"provisioningState\": \"Succeeded\",\r\n    \"sku\": {\r\n      \"name\":
         \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
-        \"Alert\",\r\n    \"additionalProperties\": {},\r\n    \"ipConfigurations\":
-        [],\r\n    \"networkRuleCollections\": [],\r\n    \"applicationRuleCollections\":
-        [],\r\n    \"natRuleCollections\": []\r\n  }\r\n}"
+        \"Deny\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '691'
+      - '804'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:31 GMT
+      - Thu, 11 Jun 2020 03:37:04 GMT
       etag:
-      - W/"31934919-2cf3-4ac3-bef2-3226134baf4b"
+      - W/"9ee01743-5b07-43b1-8542-68af9b334981"
       expires:
       - '-1'
       pragma:
@@ -212,7 +468,7 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 8521953f-0658-4e37-8421-9e2b567c84f9
+      - 16aa9a88-fce3-4bb2-9088-bf1a8df6cc5f
     status:
       code: 200
       message: OK
@@ -230,8 +486,8 @@ interactions:
       ParameterSetName:
       - -g -n
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
       accept-language:
       - en-US
     method: GET
@@ -239,24 +495,26 @@ interactions:
   response:
     body:
       string: "{\r\n  \"name\": \"af1\",\r\n  \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
-        \ \"etag\": \"W/\\\"31934919-2cf3-4ac3-bef2-3226134baf4b\\\"\",\r\n  \"type\":
+        \ \"etag\": \"W/\\\"9ee01743-5b07-43b1-8542-68af9b334981\\\"\",\r\n  \"type\":
         \"Microsoft.Network/azureFirewalls\",\r\n  \"location\": \"westus\",\r\n  \"properties\":
         {\r\n    \"provisioningState\": \"Succeeded\",\r\n    \"sku\": {\r\n      \"name\":
         \"AZFW_VNet\",\r\n      \"tier\": \"Standard\"\r\n    },\r\n    \"threatIntelMode\":
-        \"Alert\",\r\n    \"additionalProperties\": {},\r\n    \"ipConfigurations\":
-        [],\r\n    \"networkRuleCollections\": [],\r\n    \"applicationRuleCollections\":
-        [],\r\n    \"natRuleCollections\": []\r\n  }\r\n}"
+        \"Deny\",\r\n    \"additionalProperties\": {\r\n      \"DNSEnableProxy\":
+        \"False\",\r\n      \"DNSRequireProxyForNetworkRules\": \"True\",\r\n      \"DNSServer\":
+        null\r\n    },\r\n    \"ipConfigurations\": [],\r\n    \"networkRuleCollections\":
+        [],\r\n    \"applicationRuleCollections\": [],\r\n    \"natRuleCollections\":
+        []\r\n  }\r\n}"
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '691'
+      - '804'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:32 GMT
+      - Thu, 11 Jun 2020 03:37:06 GMT
       etag:
-      - W/"31934919-2cf3-4ac3-bef2-3226134baf4b"
+      - W/"9ee01743-5b07-43b1-8542-68af9b334981"
       expires:
       - '-1'
       pragma:
@@ -273,7 +531,7 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 7696c486-5045-4315-82b9-5192af5ab462
+      - 62a0376a-60d8-4309-bd62-edf4f3533ef8
     status:
       code: 200
       message: OK
@@ -291,8 +549,8 @@ interactions:
       ParameterSetName:
       - -g
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
       accept-language:
       - en-US
     method: GET
@@ -301,23 +559,24 @@ interactions:
     body:
       string: "{\r\n  \"value\": [\r\n    {\r\n      \"name\": \"af1\",\r\n      \"id\":
         \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall000001/providers/Microsoft.Network/azureFirewalls/af1\",\r\n
-        \     \"etag\": \"W/\\\"31934919-2cf3-4ac3-bef2-3226134baf4b\\\"\",\r\n      \"type\":
+        \     \"etag\": \"W/\\\"9ee01743-5b07-43b1-8542-68af9b334981\\\"\",\r\n      \"type\":
         \"Microsoft.Network/azureFirewalls\",\r\n      \"location\": \"westus\",\r\n
         \     \"properties\": {\r\n        \"provisioningState\": \"Succeeded\",\r\n
         \       \"sku\": {\r\n          \"name\": \"AZFW_VNet\",\r\n          \"tier\":
-        \"Standard\"\r\n        },\r\n        \"threatIntelMode\": \"Alert\",\r\n
-        \       \"additionalProperties\": {},\r\n        \"ipConfigurations\": [],\r\n
-        \       \"networkRuleCollections\": [],\r\n        \"applicationRuleCollections\":
+        \"Standard\"\r\n        },\r\n        \"threatIntelMode\": \"Deny\",\r\n        \"additionalProperties\":
+        {\r\n          \"DNSEnableProxy\": \"False\",\r\n          \"DNSRequireProxyForNetworkRules\":
+        \"True\",\r\n          \"DNSServer\": null\r\n        },\r\n        \"ipConfigurations\":
+        [],\r\n        \"networkRuleCollections\": [],\r\n        \"applicationRuleCollections\":
         [],\r\n        \"natRuleCollections\": []\r\n      }\r\n    }\r\n  ]\r\n}"
     headers:
       cache-control:
       - no-cache
       content-length:
-      - '796'
+      - '925'
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:34 GMT
+      - Thu, 11 Jun 2020 03:37:07 GMT
       expires:
       - '-1'
       pragma:
@@ -334,7 +593,7 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 9782fac8-4fef-467e-97ba-237352ffd485
+      - c98df6f7-041f-44a8-9e39-74638e3eddde
     status:
       code: 200
       message: OK
@@ -354,8 +613,8 @@ interactions:
       ParameterSetName:
       - -g -n
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
       accept-language:
       - en-US
     method: DELETE
@@ -364,18 +623,20 @@ interactions:
     body:
       string: ''
     headers:
+      azure-asyncnotification:
+      - Enabled
       azure-asyncoperation:
-      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/22327ec3-cf0e-401f-9883-01409981d579?api-version=2019-11-01
+      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/a61b2ae0-7d29-4236-94a5-7fd91f038f44?api-version=2019-11-01
       cache-control:
       - no-cache
       content-length:
       - '0'
       date:
-      - Wed, 15 Jan 2020 14:07:35 GMT
+      - Thu, 11 Jun 2020 03:37:08 GMT
       expires:
       - '-1'
       location:
-      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operationResults/22327ec3-cf0e-401f-9883-01409981d579?api-version=2019-11-01
+      - https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operationResults/a61b2ae0-7d29-4236-94a5-7fd91f038f44?api-version=2019-11-01
       pragma:
       - no-cache
       server:
@@ -386,9 +647,9 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 707c6407-8398-47fb-9437-bd9fd90fde18
+      - dddab03c-591d-4901-8e75-5bb422af975c
       x-ms-ratelimit-remaining-subscription-deletes:
-      - '14999'
+      - '14998'
     status:
       code: 202
       message: Accepted
@@ -406,10 +667,10 @@ interactions:
       ParameterSetName:
       - -g -n
       User-Agent:
-      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-network/9.0.0
-        Azure-SDK-For-Python AZURECLI/2.0.79
+      - python/3.7.4 (Windows-10-10.0.18362-SP0) msrest/0.6.9 msrest_azure/0.6.3 azure-mgmt-network/9.0.0
+        Azure-SDK-For-Python AZURECLI/2.7.0
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/22327ec3-cf0e-401f-9883-01409981d579?api-version=2019-11-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Network/locations/westus/operations/a61b2ae0-7d29-4236-94a5-7fd91f038f44?api-version=2019-11-01
   response:
     body:
       string: "{\r\n  \"status\": \"Succeeded\"\r\n}"
@@ -421,7 +682,7 @@ interactions:
       content-type:
       - application/json; charset=utf-8
       date:
-      - Wed, 15 Jan 2020 14:07:46 GMT
+      - Thu, 11 Jun 2020 03:37:19 GMT
       expires:
       - '-1'
       pragma:
@@ -438,7 +699,7 @@ interactions:
       x-content-type-options:
       - nosniff
       x-ms-arm-service-request-id:
-      - 400ae967-1d10-437c-886d-fa6f98c20005
+      - 768370e2-d8e3-4150-9fb6-a10cd1c35012
     status:
       code: 200
       message: OK
diff --git a/src/azure-firewall/azext_firewall/tests/latest/test_azure_firewall_scenario.py b/src/azure-firewall/azext_firewall/tests/latest/test_azure_firewall_scenario.py
--- a/src/azure-firewall/azext_firewall/tests/latest/test_azure_firewall_scenario.py
+++ b/src/azure-firewall/azext_firewall/tests/latest/test_azure_firewall_scenario.py
@@ -27,7 +27,12 @@ def test_azure_firewall(self, resource_group):
             'rule1': 'rule1',
             'rule2': 'rule2'
         })
-        self.cmd('network firewall create -g {rg} -n {af}')
+        self.cmd('network firewall create -g {rg} -n {af} --threat-intel-mode Alert', checks=[
+            self.check('threatIntelMode', 'Alert')
+        ])
+        self.cmd('network firewall update -g {rg} -n {af} --threat-intel-mode Deny', checks=[
+            self.check('threatIntelMode', 'Deny')
+        ])
         self.cmd('network firewall show -g {rg} -n {af}')
         self.cmd('network firewall list -g {rg}')
         self.cmd('network firewall delete -g {rg} -n {af}')