{
    "id": "WAF",
    "title": "Azure Web Application Firewall (WAF)",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Connect to the Azure Web Application Firewall (WAF) for Application Gateway, Front Door, or CDN. This WAF protects your applications from common web vulnerabilities such as SQL injection and cross-site scripting, and lets you customize rules to reduce false positives. Follow these instructions to stream your Microsoft Web application firewall logs into Microsoft Sentinel. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2223546&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "logo": "MicrosoftWebApplication.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Application Gateways",
            "baseQuery": "AzureDiagnostics | where ResourceType == \"APPLICATIONGATEWAYS\""
        },
        {
            "metricName": "Total data received",
            "legend": "FrontDoors",
            "baseQuery": "AzureDiagnostics | where ResourceType == \"FRONTDOORS\""
        },
        {
            "metricName": "Total data received",
            "legend": "CDN",
            "baseQuery": "AzureDiagnostics | where ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "AzureDiagnostics | where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\n            | sort by TimeGenerated"
        },
        {
            "description": "Blocked actions",
            "query": "AzureDiagnostics | where ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\n            | where OperationName == \"ApplicationGatewayFirewall\"| where action_s == \"Blocked\"\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "AzureDiagnostics | where ResourceType == \"APPLICATIONGATEWAYS\"\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AzureDiagnostics | where ResourceType == \"FRONTDOORS\"\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AzureDiagnostics | where ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "AzureDiagnostics (Application Gateways)",
            "lastDataReceivedQuery": "AzureDiagnostics | where ResourceType == \"APPLICATIONGATEWAYS\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AzureDiagnostics (FrontDoors)",
            "lastDataReceivedQuery": "AzureDiagnostics | where ResourceType == \"FRONTDOORS\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AzureDiagnostics (CDN)",
            "lastDataReceivedQuery": "AzureDiagnostics | where ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Azure WAF to Microsoft Sentinel",
            "description": "Go to each WAF resource type and choose your WAF.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenWaf"
                    },
                    "type": "InstallAgent"
                },
                {
                    "parameters": {
                        "linkType": "OpenFrontDoors"
                    },
                    "type": "InstallAgent"
                },
                {
                    "parameters": {
                        "linkType": "OpenCdnProfile"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "",
            "description": "Inside your WAF resource:\n\n1.  Select **Diagnostic logs.​**\n2.  Select **+ Add diagnostic setting.​**\n3.  In the **Diagnostic setting** blade:\n    -   Type a **Name**.\n    -   Select **Send to Log Analytics**.\n    -   Choose the log destination workspace.​\n    -   Select the categories that you want to analyze (recommended: ApplicationGatewayAccessLog, ApplicationGatewayFirewallLog, FrontdoorAccessLog, FrontdoorWebApplicationFirewallLog, WebApplicationFirewallLogs).​\n    -   Click **Save**."
        }
    ]
}