Kusto queries FW

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where OperationName == "AzureFirewallNetworkRuleLog"
| where msg_s contains "TCP"
| where msg_s contains "10.x.x.x" and msg_s contains "Deny"
| project msg_s

AzureDiagnostics
| where msg_s contains "10.x.x.x"
| project msg_s

AzureDiagnostics
| where ResourceType == "AZUREFIREWALLS" and action_s == "Deny" and src_ip_s == "source_ip" and dest_ip_s == "destination_ip"