(Created page with "== WAF Logs == Check for WAF policy breaks with the following Query in Log analytics workspace:<syntaxhighlight lang="sql"> AzureDiagnostics | where TimeGenerated > ago(15m) | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" </syntaxhighlight>") |
No edit summary |
||
| Line 4: | Line 4: | ||
| where TimeGenerated > ago(15m) | | where TimeGenerated > ago(15m) | ||
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | ||
</syntaxhighlight>Check WAF logs for the connections to the backend pools:<syntaxhighlight lang="powershell"> | |||
AzureDiagnostics | |||
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog" | |||
| project TimeGenerated, Resource, backendPoolName_s, requestUri_s, httpStatus_d, clientIP_s, host_s | |||
| summarize connectionCount = count() by backendPoolName_s, host_s | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 13:21, 6 November 2025
WAF Logs
Check for WAF policy breaks with the following Query in Log analytics workspace:
AzureDiagnostics
| where TimeGenerated > ago(15m)
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog"
Check WAF logs for the connections to the backend pools:
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and Category == "ApplicationGatewayAccessLog"
| project TimeGenerated, Resource, backendPoolName_s, requestUri_s, httpStatus_d, clientIP_s, host_s
| summarize connectionCount = count() by backendPoolName_s, host_s