diff --git a/modules/integration_azure-firewall/conf/00-heartbeat.yaml b/modules/integration_azure-firewall/conf/00-heartbeat.yaml
index 63808075d..f45dffb40 100644
--- a/modules/integration_azure-firewall/conf/00-heartbeat.yaml
+++ b/modules/integration_azure-firewall/conf/00-heartbeat.yaml
@@ -3,7 +3,7 @@ module: Azure firewall
 name: heartbeat
 
 transformation: true
-aggregation: true
+aggregation: ".mean(by=['azure_resource_name', 'azure_resource_group_name', 'azure_region'])"
 
 filtering: "filter('resource_type', 'Microsoft.Network/azureFirewalls') and filter('primary_aggregation_type', 'true')"
 
diff --git a/modules/integration_azure-firewall/variables-gen.tf b/modules/integration_azure-firewall/variables-gen.tf
index 974d3f0e8..96b9e4a05 100644
--- a/modules/integration_azure-firewall/variables-gen.tf
+++ b/modules/integration_azure-firewall/variables-gen.tf
@@ -9,7 +9,7 @@ variable "heartbeat_notifications" {
 variable "heartbeat_aggregation_function" {
   description = "Aggregation function and group by for heartbeat detector (i.e. \".mean(by=['host'])\")"
   type        = string
-  default     = ""
+  default     = ".mean(by=['azure_resource_name', 'azure_resource_group_name', 'azure_region'])"
 }
 
 variable "heartbeat_transformation_function" {