Azure Firewall KQL Query
This is a quick post to share a useful KQL query for Azure Firewalls that I’ve been using. It’s based on the default Firewall query from Microsoft, but with some added variables to allow for a more focused analysis of source and destination traffic. I’m putting it here for my future reference and in case it’s helpful for anyone else. Azure Firewall Query with Variables This query allows you to analyze Azure Firewall logs, focusing on specific source and destination IP addresses within a defined time range. It’s particularly useful for troubleshooting and security analysis. ...