:::: MENU ::::

Find blocked requests by Azure WAF in Log Analytics

Assuming that you have correctly connected Azure WAF to Log Analytics you can run a simple query to list all the requests that have been blocked by WAF

AzureDiagnostics
| where ResourceType == "FRONTDOORS" and Category == "FrontdoorWebApplicationFirewallLog"
| where action_s =~ "block"
| order by TimeGenerated desc