KQL snippet: list Azure WAF blocked URIs quickly

When a WAF blocks traffic, starting with the most affected URIs avoids chasing an isolated request. This query gives a first usable view by hostname, URI, and rule.

AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "ApplicationGatewayFirewallLog"
| where action_s =~ "Blocked"
| summarize hits = count() by hostname_s, requestUri_s, ruleId_s, Message
| top 20 by hits desc

Read the result carefully: high volume does not automatically mean false positive. Check HTTP method, parameters, source IP, user-agent, and application context before adding an exclusion.