Azure WAF logging analytics and alerting | Part 2 of 2

Subscribe here, new videos posted weekly:
/ @cloudinspired
This video is Part 2 covering Web Application Firewall or WAF for short logging and diagnostics using Application Gateway and Log Analytics.
We will also take a look at the WAF logs, running queries to search log data and email alerting of that data.
Part 2 covers WAF logging and diagnostics using:
Application Gateway Analytics
Log Analytics for Application Gateway Firewall Logs
Log Analytics running queries to search log data
Email alerting
Part 1 video is here • Azure Web Application ...

[@simonbutler3516]

Thanks for posting these 2 videos. I was totally stuck! Cheers.

[@CloudInspired]

No problem Simon, Glad it helped!

[@morecklgust]

This was really helpful even after 4 years, Thanks I do have one question in detection mode I get "Matched" and "Detected" in action_s. I created custom rules that should allow (Pass) the traffic. it is just nebulous to me what will happen in prevention mode. Can you tell me?

[@devopsengineer1798]

where is the query in description ?

[@bproducer]

Why is your custom rule being listed as a mandatory rule and cannot be disabled?

[@matteustace5769]

@Cloud Inspired It looks like MS has changed something, you can no longer find "Azure Application Gateway Analytics" in the marketplace. Possibly this is just standard in Log Analytics Workspaces now, but probably time for a re-shoot of that section of hte video!

[@CloudInspired]

Thanks Matt. I`ll check it out!

[@mohamedfarouk4870]

Thanks a lot for this great video it is really very helpfull

[@CloudInspired]

Glad it helped you Mohamed.

[@gururajma5448]

Hi, In Log Analytics, i am not able to set the query action_s == "Blocked". action_s field itself not appearing in query box. could you plz help me how to get that "action_s"

[@CloudInspired]

Hello - Are you referring to this part of the video: kzbin.info/www/bejne/q4ixgpKHdraEatE If so, cut and paste the following query into log analytics and run the query. AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog" and action_s == "Blocked" It should then show all "blocked" events in the application gateway firewall logs if these type of events are present in the logs? If no events are present as "Blocked" under "action_s", these shouldn`t display. Try running: AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog" to see what "action_s" type is displayed?

[@ayekula]

Thanks a lot for sharing Very good information and explaining in detail.....Thanks, Could you please share me how to send these Blocked logs to SIEM

[@CloudInspired]

Thanks Ayekula, you could use Log Analytics integration with Power BI if that helps for your requirements? docs.microsoft.com/en-us/azure/azure-monitor/logs/log-powerbi Then set data alerts in the Power BI service.

[@midnightwatchman1]

This is a good video but for me represent everything wrong with video presentation over writing articles, all the information you need is between 5:01 and 5:05 but then you have to rewind that spot and 10 times to hear what the presenter said and writing on the video is just too fuzzy

[@CloudInspired]

Hi Steve, thanks for the comment. Its really down to personal preference and the advantages and disadvantages of a video over an article. Also regarding the content, this all depends what knowledge you require at the time of viewing. Videos are released and built up, trying to keep them as simple and quick as possible from start to finish with all the components required to achieve the result. Trying not to jump too much into the outcome without covering what’s required first, otherwise this can be confusing to the viewer if they have no previous knowledge of the subject.

[@midnightwatchman1]

@@CloudInspiredthese days finding articles on new technology is getting hard to find. you have to wait on a book or try and see if the Microsoft documentation is up to standard. once the video is done at a reasonable speed it is ok and the presenter does skip too much it fine. thank you for the reply and thanks for the tip. you would believe how that one tip saved my life

[@CloudInspired]

No problem Steve, glad it helped you. All the best.

[@CarlosDiaz-nc8wl]

Thanks!

[@CloudInspired]

Your welcome Carlos