This is a quick post on how to query Azure Firewall logs using Kusto Query Language (KQL). It's not a deep dive into KQL, but rather a quick reference of useful queries for future Brad.

Network Rules

To find denied traffic between a source and destination IP address I found adding the following to the bottom of the pre-canned Network rule log data query useful:

Kusto Query Language (KQL)
  // ...
  // Add to bottom of query and run
  | where SourceIP contains "src-ip"
  | where TargetIP contains "dst-ip"
  | where Action contains "Deny"


As time goes on, I'll add more queries to this post.

# azure
# cloud