(Created page with "== WAF Logs == Check for WAF policy breaks with the following Query in Log analytics workspace:<syntaxhighlight lang="sql"> AzureDiagnostics | where TimeGenerated > ago(15m) | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" </syntaxhighlight>") |
No edit summary |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
=== Azure App Gateway === | |||
== WAF Logs == | == WAF Logs == | ||
Check for WAF policy breaks with the following Query in Log analytics workspace:<syntaxhighlight lang="sql"> | Check for WAF policy breaks with the following Query in Log analytics workspace:<syntaxhighlight lang="sql"> | ||
| Line 4: | Line 6: | ||
| where TimeGenerated > ago(15m) | | where TimeGenerated > ago(15m) | ||
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | ||
</syntaxhighlight>Check WAF logs for the connections to the backend pools:<syntaxhighlight lang="sql"> | |||
AzureDiagnostics | |||
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog" | |||
| project TimeGenerated, Resource, backendPoolName_s, requestUri_s, httpStatus_d, clientIP_s, host_s | |||
| summarize connectionCount = count() by backendPoolName_s, host_s | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Latest revision as of 13:22, 6 November 2025
Azure App Gateway
WAF Logs
Check for WAF policy breaks with the following Query in Log analytics workspace:
AzureDiagnostics
| where TimeGenerated > ago(15m)
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog"
Check WAF logs for the connections to the backend pools:
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog"
| project TimeGenerated, Resource, backendPoolName_s, requestUri_s, httpStatus_d, clientIP_s, host_s
| summarize connectionCount = count() by backendPoolName_s, host_s