Azure Application Gateway Logs

Application Gateway Logs

Get Blocked Traffic

Get recent blocked traffic

1
2
3
AGWFirewallLogs
| where Action == "Blocked"
| top 100 by TimeGenerated desc

Get traffic blocked by Uri

1
2
3
4
AGWFirewallLogs
| where Action == "Blocked"
| where RequestUri contains "<uri eg /api/apiname>"
| top 100 by TimeGenerated desc

Get blocks by policy ID based on content

1
2
3
4
AGWFirewallLogs
| where DetailedData contains "ARGS:content"
| summarize Count=count() by PolicyScopeName, RuleId
| order by PolicyScopeName, RuleId

App Service Kudu Console Azureactivation