Jump to content
  • entries
  • comments
  • views

Serverless Computing | Email Report Azure WAF Logs




At this post, we will create a Logic App that will query the Log Analytics workspace for the WAF logs of the last 24 hours and send the results in an email, using a free SendGrid account.
A Web Application Firewall protects your application from common web vulnerabilities. Azure provides enterprise grade Web Application Firewall through the Application Gateway. You can read more at my previous post: https://www.e-apostolidis.gr/microsoft/azure/protect-your-web-application-with-azure-application-gateway-waf/ Use Log Analytics to Query the WAF Logs
The Application Gateway WAF sends its logs to the Log Analytics workspace. You can see them using a typical query like the below, that will list all events at the past 24 hours.
AzureDiagnostics | where Resource == “PROWAF” and OperationName == “ApplicationGatewayFirewall” | where TimeGenerated > ago(24h) | summarize count() by TimeGenerated, clientIp_s , TimeGenerated , ruleId_s , Message , details_message_s , requestUri_s, details_file_s , hostname_simage-23-1024x439.png
You can save the query by clicking the Save button and give it a name and a Category.image-17.png
We can send those logs as email by using an Azure Logic App and a SendGrid account. You can see how to create a SendGrid free account at my previous post: https://www.e-apostolidis.gr/microsoft/azure/azure-free-smtp-relay-using-sendgrid/ Create a Logic App
From the portal.azure.com, Create a resource and write “logic app”, click the “Logic App”and press “Create”image-10.png
At the Logic App creation wizard add Name, subscription, resource group, location and press Createimage-11.png
Next the Logic App will be created. Open it and from the Logics App Designer select the “Recurrence” common trigger.image-12.png
Change the Recurrence Interval to “1” and the Frequency to “Day” and press the “+ New step”image-14.png
search for “log analytics” and select the “Run query and visualize results”image-24.png
I will proceed with “Sign in”, you can also use a Service Principal but we will cover this to another post.image-16.png
After you login select the Subscription, Resource Group and the Log Analytics Workspace. Next, add the query, for Chart Type select “Html Table” and add a “Next Step”image-26.png

search for “sendgrid” and select the “Send email (V2)”image-19.png
Add a name for the connection and the API key that you created at the SendGrid creation post and press create. https://www.e-apostolidis.gr/microsoft/azure/azure-free-smtp-relay-using-sendgrid/image-20.png
Fill the From address, To address and Subject. At the email body, add dynamic content and select the blocs of the previous set result.image-25.png
Press Save to save the Flow and Run to test it.image-22.png
The result at my email:



Recommended Comments

There are no comments to display.

Add a comment...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...