Snippets

KQL snippet: prepare evidence for a managed WAF rule exclusion

A short query to isolate rule, field, URI and examples before proposing a targeted WAF exclusion.

23 Jun 2026 azurewafapplication-gatewaykqlsecuritylogsfalse-positiverunbookmonitoring

Before creating a WAF exclusion, gather enough evidence to keep the scope limited to one rule, one field and one URI family.

kusto waf-managed-rule-exclusion-evidence.kql

let Window = 24h;
let RuleId = "942100";
AzureDiagnostics
| where TimeGenerated > ago(Window)
| where ResourceProvider == "MICROSOFT.NETWORK"
| where Category == "ApplicationGatewayFirewallLog"
| where ruleId_s == RuleId
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Examples=make_set(requestUri_s, 5) by action_s, ruleSetType_s, ruleSetVersion_s, ruleGroup_s, ruleId_s, matchVariableName_s, selector_s, site_s
| order by Hits desc

Quick read: if hits concentrate on a single selector_s, the exclusion can stay targeted; if multiple URIs or fields appear, first prefer application fixes, encoding changes or a time-boxed detection-mode change.