Snippets

KQL snippet: qualify an Azure Firewall denial on private egress

A short query to separate application rule denial, network rule denial and DNS proxy resolution before adding an overbroad rule.

18 Jun 2026 azurefirewallegressdnskqllogsnetworkingrunbookmonitoring

When a private workload can no longer reach an external dependency, qualify the denial layer in Azure Firewall before broadening rules.

kusto azure-firewall-private-egress-denials.kql

let Window = 2h;
let SourcePrefix = "10.42.";
let Target = "api.partner.example.com";
AzureDiagnostics
| where TimeGenerated > ago(Window)
| where ResourceProvider == "MICROSOFT.NETWORK"
| where Category in ("AzureFirewallApplicationRule", "AzureFirewallNetworkRule", "AzureFirewallDnsProxy")
| where msg_s has Target or SourceIP_s startswith SourcePrefix or Fqdn_s has Target
| project TimeGenerated,
        Category,
        SourceIP_s,
        SourcePort_s,
        Fqdn_s,
        DestinationIp_s,
        DestinationPort_s,
        Protocol_s,
        Action_s,
        RuleCollection_s,
        Rule_s,
        msg_s
| order by TimeGenerated desc

Quick read: a DNS proxy denial points to suffix, resolver or DNS target; an ApplicationRule denial should be handled by FQDN and protocol; a NetworkRule denial must be justified by IP, port and source route, not by a generic opening.