Kusto queries FW - Revision history

Busk at 16:11, 18 November 2024

2024-11-18T16:11:05Z

Busk at 00:27, 16 November 2024

2024-11-16T00:27:19Z

Busk at 00:15, 16 November 2024

2024-11-16T00:15:07Z

Busk at 23:20, 19 August 2024

2024-08-19T23:20:37Z

Busk at 19:59, 3 May 2024

2024-05-03T19:59:56Z

Busk: Created page with "``` AzureDiagnostics | where msg_s contains "10.x.x.x" | project msg_s ``` ``` AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" and action_s == "Deny" and src_ip_s =..."

2024-05-03T19:54:40Z

Created page with "``` AzureDiagnostics | where msg_s contains "10.x.x.x" | project msg_s ``` ``` AzureDiagnostics | where ResourceType == "AZUREFIREWALLS" and action_s == "Deny" and src_ip_s =..."

New page

```
AzureDiagnostics
| where msg_s contains "10.x.x.x"
| project msg_s
```

```
AzureDiagnostics
| where ResourceType == "AZUREFIREWALLS" and action_s == "Deny" and src_ip_s == "source_ip" and dest_ip_s == "destination_ip"
```

@@ Line 3: / Line 3: @@
 | where ResourceType == "AZUREFIREWALLS" and Category == "AzureFirewallNetworkRule"
 | where msg_s contains "10.1.1.1"
 | limit 10
 ```

← Older revision		Revision as of 00:27, 16 November 2024
Line 68:		Line 68:


		+	```
		+
		+
		+	# Unvalidated
		+	```
		+	AzureDiagnostics
		+	\| where ResourceType == "AZUREFIREWALLS"
		+	\| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule" or Category == "AzureFirewallDnsProxy"
		+	\| where tostring(parse_json(msg_s)) contains "192.168.1.1"
		+	\| project TimeGenerated, msg_s, Resource, ResourceGroup, SubscriptionId
		+	\| order by TimeGenerated desc
	```		```

← Older revision		Revision as of 00:15, 16 November 2024
Line 1:		Line 1:
		+	```
		+	AzureDiagnostics
		+	\| where ResourceType == "AZUREFIREWALLS" and Category == "AzureFirewallNetworkRule"
		+	\| where msg_s contains "10.1.1.1"
		+	\| limit 10
		+	```
		+
	```		```
	AzureDiagnostics		AzureDiagnostics

@@ Line 17: / Line 17: @@
 AzureDiagnostics
 | where ResourceType == "AZUREFIREWALLS" and action_s == "Deny" and src_ip_s == "source_ip" and dest_ip_s == "destination_ip"
 ```

← Older revision		Revision as of 19:59, 3 May 2024
Line 1:		Line 1:
		+	```
		+	AzureDiagnostics
		+	\| where Category == "AzureFirewallNetworkRule"
		+	\| where OperationName == "AzureFirewallNetworkRuleLog"
		+	\| where msg_s contains "TCP"
		+	\| where msg_s contains "10.x.x.x" and msg_s contains "Deny"
		+	\| project msg_s
		+	```
		+
	```		```
	AzureDiagnostics		AzureDiagnostics