diff --git a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/azureFirewall.json b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/azureFirewall.json
index 376d056c03b7..1c56b35f2ecd 100644
--- a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/azureFirewall.json
+++ b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/azureFirewall.json
@@ -335,6 +335,10 @@
             "provisioningState":{  
                "description":"The provisioning state of the resource.",
                "$ref":"#/definitions/ProvisioningState"
+            },
+            "threatIntelMode":{
+               "description":"The operation mode for Threat Intelligence.",
+               "$ref":"#/definitions/AzureFirewallThreatIntelMode"
             }
          },
          "description":"Properties of the Azure Firewall."
@@ -374,6 +378,19 @@
          },
          "description":"Response for ListAzureFirewalls API service call."
       },
+      "AzureFirewallThreatIntelMode":{
+         "type":"string",
+         "description":"The operation mode for Threat Intel",
+         "enum":[
+            "Alert",
+            "Deny",
+            "Off"
+         ],
+         "x-ms-enum":{
+            "name":"AzureFirewallThreatIntelMode",
+            "modelAsString":true
+         }
+      },
       "AzureFirewallApplicationRuleCollectionPropertiesFormat":{  
          "properties":{  
             "priority":{  
@@ -714,7 +731,8 @@
          "description":"The action type of a rule collection",
          "enum":[  
             "Allow",
-            "Deny"
+            "Deny",
+            "Alert"
          ],
          "x-ms-enum":{  
             "name":"AzureFirewallRCActionType",
diff --git a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallGet.json b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallGet.json
index aa1b836a510e..95b1899e175a 100644
--- a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallGet.json
+++ b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallGet.json
@@ -18,6 +18,7 @@
             },
             "properties":{  
                "provisioningState":"Succeeded",
+               "threatIntelMode": "Alert",
                "ipConfigurations":[  
                   {  
                      "name":"azureFirewallIpConfiguration",
diff --git a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListByResourceGroup.json b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListByResourceGroup.json
index 06f15d455139..035f2d0c1130 100644
--- a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListByResourceGroup.json
+++ b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListByResourceGroup.json
@@ -19,6 +19,7 @@
                   },
                   "properties":{  
                      "provisioningState":"Succeeded",
+                     "threatIntelMode": "Alert",
                      "ipConfigurations":[  
                         {  
                            "name":"azureFirewallIpConfiguration",
diff --git a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListBySubscription.json b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListBySubscription.json
index fa2bdb34193c..0a268c0e1063 100644
--- a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListBySubscription.json
+++ b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallListBySubscription.json
@@ -18,6 +18,7 @@
                   },
                   "properties":{  
                      "provisioningState":"Succeeded",
+                     "threatIntelMode": "Alert",
                      "ipConfigurations":[  
                         {  
                            "name":"azureFirewallIpConfiguration",
diff --git a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallPut.json b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallPut.json
index 4a2afcc66a28..d4a570a5e441 100644
--- a/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallPut.json
+++ b/specification/network/resource-manager/Microsoft.Network/stable/2018-12-01/examples/AzureFirewallPut.json
@@ -9,6 +9,7 @@
             "key1":"value1"
          },
          "properties":{  
+            "threatIntelMode": "Alert",
             "ipConfigurations":[  
                {  
                   "name":"azureFirewallIpConfiguration",
@@ -124,6 +125,7 @@
             },
             "properties":{  
                "provisioningState":"Succeeded",
+               "threatIntelMode": "Alert",
                "ipConfigurations":[  
                   {  
                      "name":"azureFirewallIpConfiguration",
@@ -242,6 +244,7 @@
             },
             "properties":{  
                "provisioningState":"Succeeded",
+               "threatIntelMode": "Alert",
                "ipConfigurations":[  
                   {  
                      "name":"azureFirewallIpConfiguration",