Azure Firewall Log Analytics

Intro

This is a quick post on how to query Azure Firewall logs using Kusto Query Language (KQL). It's not a deep dive into KQL, but rather a quick reference of useful queries for future Brad.

Network Rules

To find denied traffic between a source and destination IP address I found adding the following to the bottom of the pre-canned Network rule log data query useful:

AzureDiagnostics
  // ...
  // Add to bottom of query and run
  | where SourceIP contains "src-ip"
  | where TargetIP contains "dst-ip"
  | where Action contains "Deny"

Outro

As time goes on, I'll add more queries to this post.