Hello, community! I'm having trouble identifying specific changes to Azure Firewall rules through KQL (Kusto Query Language). After modifying certain firewall rules, I can see that edits have occurred through the firewall’s logs tab (where it shows a JSON indicating that an edit happened), but I'm unable to find any detailed information on which rule was actually modified or what exactly was changed. Here’s what I’ve tried so far, without success: Querying the AzureActivity table to locate edit events. Checking the AzureDiagnostics table. Running queries for Microsoft.Network/azureFirewalls/write events with KQL. Despite these attempts, I haven't been able to pinpoint logs that specify which rules were altered. Has anyone experienced this or have any insights on how to get more detailed logs about specific rule changes in Azure Firewall? Thanks in advance for any assistance!

Difficulty Identifying Edited Rules in Azure Firewall Logs via KQL

Hyago Santana Mariano 20

Hello, community!

I'm having trouble identifying specific changes to Azure Firewall rules through KQL (Kusto Query Language). After modifying certain firewall rules, I can see that edits have occurred through the firewall’s logs tab (where it shows a JSON indicating that an edit happened), but I'm unable to find any detailed information on which rule was actually modified or what exactly was changed.

Here’s what I’ve tried so far, without success:

Querying the AzureActivity table to locate edit events.
Checking the AzureDiagnostics table.
Running queries for Microsoft.Network/azureFirewalls/write events with KQL.

Despite these attempts, I haven't been able to pinpoint logs that specify which rules were altered. Has anyone experienced this or have any insights on how to get more detailed logs about specific rule changes in Azure Firewall?

Thanks in advance for any assistance! User's image

User's image

Rohith Vinnakota 1,085 Reputation points Microsoft Vendor

2024-11-07T23:33:46.27+00:00
Hi Hyago Santana Mariano,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that which rules are updated in the firewall

From log analytics AzureActivity log table will get the above information. Try to query data where OperationName column value is Creates or updates an Azure Firewall or OperationNameValue column value is Microsoft.Network/azureFirewalls/write.

Try this below command:

AzureActivity | where OperationName == 'Creates or updates an Azure Firewall'

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Difficulty Identifying Edited Rules in Azure Firewall Logs via KQL

Your answer