No edit summary |
|||
| Line 4: | Line 4: | ||
| where TimeGenerated > ago(15m) | | where TimeGenerated > ago(15m) | ||
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | ||
</syntaxhighlight>Check WAF logs for the connections to the backend pools:<syntaxhighlight lang=" | </syntaxhighlight>Check WAF logs for the connections to the backend pools:<syntaxhighlight lang="sql"> | ||
AzureDiagnostics | AzureDiagnostics | ||
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog" | | where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog" | ||
Revision as of 13:22, 6 November 2025
WAF Logs
Check for WAF policy breaks with the following Query in Log analytics workspace:
AzureDiagnostics
| where TimeGenerated > ago(15m)
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog"
Check WAF logs for the connections to the backend pools:
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog"
| project TimeGenerated, Resource, backendPoolName_s, requestUri_s, httpStatus_d, clientIP_s, host_s
| summarize connectionCount = count() by backendPoolName_s, host_s