Jump to content













Photo
- - - - -

Serverless Computing | Email Report Azure WAF Logs

  Posted by Pantelis Apostolidis , in Azure 28 December 2018 · 12 views

<p>At this post, we will create a Logic App that will query the Log Analytics workspace for the WAF logs of the last 24 hours and send the results in an email, using a free SendGrid account.</p>

 

 

<p>A Web Application Firewall protects your application from common web vulnerabilities. Azure provides enterprise grade Web Application Firewall through the Application Gateway. You can read more at my previous post: <a href="https://www.e-aposto...ateway-waf/</a></p>

 

 

<h2>Use Log Analytics to Query the WAF Logs</h2>

 

 

<p>The Application Gateway WAF sends its logs to the Log Analytics workspace. You can see them using a typical query like the below, that will list all events at the past 24 hours.</p>

 

<p>AzureDiagnostics | where Resource == “PROWAF” and OperationName == “ApplicationGatewayFirewall” | where TimeGenerated > ago(24h) | summarize count() by TimeGenerated, clientIp_s , TimeGenerated , ruleId_s , Message , details_message_s , requestUri_s, details_file_s , hostname_s</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...3-1024x439.png"alt="waflogicappreports" class="wp-image-2367" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-23-1024x439.png 1024w, https://www.e-aposto...-23-300x129.png 300w, https://www.e-aposto...-23-768x330.png 768w, https://www.e-aposto...-23-600x258.png 600w, https://www.e-aposto...12/image-23.png 1398w" sizes="(max-width: 1024px) 100vw, 1024px" /></figure>

 

 

<p>You can save the query by clicking the Save button and give it a name and a Category.</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-17.png"alt="waflogicappreports" class="wp-image-2360" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-17.png 493w, https://www.e-aposto...-17-300x136.png 300w" sizes="(max-width: 493px) 100vw, 493px" /></figure>

 

 

<p>We can send those logs as email by using an Azure Logic App and a SendGrid account. You can see how to create a SendGrid free account at my previous post: <a href="https://www.e-aposto...ndgrid/</a></p>

 

 

<h2>Create a Logic App</h2>

 

 

<p>From the portal.azure.com, Create a resource and write “logic app”, click the “Logic App”and press “Create”</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-10.png"alt="waflogicappreports" class="wp-image-2351" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-10.png 511w, https://www.e-aposto...-10-300x178.png 300w" sizes="(max-width: 511px) 100vw, 511px" /><figcaption><br></figcaption></figure>

 

 

<p>At the Logic App creation wizard add Name, subscription, resource group, location and press Create</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-11.png"alt="waflogicappreports" class="wp-image-2352" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-11.png 462w, https://www.e-aposto...-11-300x270.png 300w" sizes="(max-width: 462px) 100vw, 462px" /><figcaption><br></figcaption></figure>

 

 

<p>Next the Logic App will be created. Open it and from the Logics App Designer select the “Recurrence” common trigger.</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-12.png"alt="waflogicappreports" class="wp-image-2354" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-12.png 622w, https://www.e-aposto...-12-300x127.png 300w, https://www.e-aposto...-12-600x255.png 600w" sizes="(max-width: 622px) 100vw, 622px" /></figure>

 

 

<p>Change the Recurrence Interval to “1” and the Frequency to “Day” and press the “+ New step”</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-14.png"alt="waflogicappreports" class="wp-image-2357" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-14.png 621w, https://www.e-aposto...-14-300x110.png 300w, https://www.e-aposto...-14-600x219.png 600w" sizes="(max-width: 621px) 100vw, 621px" /></figure>

 

 

<p>search for “log analytics” and select the “Run query and visualize results”</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-24.png"alt="waflogicappreports" class="wp-image-2368" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-24.png 585w, https://www.e-aposto...-24-300x256.png 300w" sizes="(max-width: 585px) 100vw, 585px" /></figure>

 

 

<p>I will proceed with “Sign in”, you can also use a Service Principal but we will cover this to another post.</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-16.png"alt="waflogicappreports" class="wp-image-2359" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-16.png 627w, https://www.e-aposto...-16-300x126.png 300w, https://www.e-aposto...-16-600x253.png 600w" sizes="(max-width: 627px) 100vw, 627px" /></figure>

 

 

<p>After you login select the Subscription, Resource Group and the Log Analytics Workspace. Next, add the query, for Chart Type select “Html Table” and add a “Next Step”</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-26.png"alt="waflogicappreports" class="wp-image-2370" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-26.png 602w, https://www.e-aposto...-26-300x167.png 300w, https://www.e-aposto...-26-600x334.png 600w, https://www.e-aposto...-26-360x200.png 360w" sizes="(max-width: 602px) 100vw, 602px" /></figure>

 

 

<p></p>

 

 

<p>search for “sendgrid” and select the “Send email (V2)”</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-19.png"alt="waflogicappreports" class="wp-image-2363" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-19.png 581w, https://www.e-aposto...-19-150x150.png 150w, https://www.e-aposto...-19-300x298.png 300w" sizes="(max-width: 581px) 100vw, 581px" /></figure>

 

 

<p>Add a name for the connection and the API key that you created at the SendGrid creation post and press create. <a href="https://www.e-aposto...ndgrid/</a></p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-20.png"alt="waflogicappreports" class="wp-image-2364" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-20.png 612w, https://www.e-aposto...-20-300x103.png 300w, https://www.e-aposto...-20-600x207.png 600w" sizes="(max-width: 612px) 100vw, 612px" /></figure>

 

 

<p>Fill the From address, To address and Subject. At the email body, add dynamic content and select the blocs of the previous set result.</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-25.png"alt="waflogicappreports" class="wp-image-2369" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-25.png 844w, https://www.e-aposto...-25-300x130.png 300w, https://www.e-aposto...-25-768x332.png 768w, https://www.e-aposto...-25-600x259.png 600w" sizes="(max-width: 844px) 100vw, 844px" /></figure>

 

 

<p>Press Save to save the Flow and Run to test it.</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-22.png"alt="waflogicappreports" class="wp-image-2366" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-22.png 525w, https://www.e-aposto...e-22-300x68.png 300w" sizes="(max-width: 525px) 100vw, 525px" /></figure>

 

 

<p>The result at my email:</p>

 

 

<figure class="wp-block-image"><img src="https://www.e-aposto...2/image-27.png"alt="waflogicappreports" class="wp-image-2372" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/12/image-27.png 885w, https://www.e-aposto...-27-300x118.png 300w, https://www.e-aposto...-27-768x302.png 768w, https://www.e-aposto...-27-600x236.png 600w" sizes="(max-width: 885px) 100vw, 885px" /></figure>

 

 

<p></p>

 

 

<p></p>

 

 

<p></p>
<p><a class="a2a_button_email" href="https://www.addtoany...Azure WAF Logs"title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_print" href="https://www.addtoany.com/add_to/print?linkurl=https%3A%2F%2Fwww.e-apostolidis.gr%2Fmicrosoft%2Fazure%2Fserverless-computing-email-report-azure-waf-logs%2F&amp;linkname=Serverless%20Computing%20%7C%20%20Email%20Report%20Azure%20WAF%20Logs" title="Print" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share#url=https%3A%2F%2Fwww.e-apostolidis.gr%2Fmicrosoft%2Fazure%2Fserverless-computing-email-report-azure-waf-logs%2F&title=Serverless%20Computing%20%7C%20%20Email%20Report%20Azure%20WAF%20Logs" data-a2a-url="https://www.e-apostolidis.gr/microsoft/azure/serverless-computing-email-report-azure-waf-logs/" data-a2a-title="Serverless Computing | Email Report Azure WAF Logs"><img src="https://static.addtoany.com/buttons/share_save_171_16.png" alt="Share"></a></p><p>The post <a rel="nofollow" href="https://www.e-apostolidis.gr/microsoft/azure/serverless-computing-email-report-azure-waf-logs/">Serverless Computing | Email Report Azure WAF Logs</a> appeared first on <a rel="nofollow" href="https://www.e-apostolidis.gr">Apostolidis IT Corner</a>.</p>


<a href="https://www.e-aposto...zure-waf-logs/"class='bbc_url' rel='nofollow external'>Source</a>