Azure WAF Notebook for Microsoft Sentinel
Azure Web Application Firewall (Azure WAF) detects SQLI attacks and applies block mitigations by default. In certain instances, this could be a false positive that requires investigation and creation of Azure WAF exclusions. In order to complete a successful investigation, full context about the attack is needed and a process that guides you through the investigation is required. Such a guided investigation process is automated in this Microsoft Sentinel Notebook and allows you to tune Azure WAF policy with minimal user interaction.
This Notebook analyzes SQL injection attacks on Azure WAF integrated with Azure Front Door premium and implements automated exclusions.
This notebook is released in preview.
You can find step-by-step instructions on how to use the Notebook here: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/tutorial-get-started-with-azure-waf-investigation-notebook/ba-p/3733438
Published on:
Learn moreRelated posts
IPv6 Adoption: Enhancing Azure WAF on Front Door
The transition to IPv6 is a significant step for enterprise corporations, reflecting the evolution of internet technology and the need for a l...
Azure WAF’s Bot Manager 1.1 and JavaScript Challenge (Preview): Navigating the Bot Threat Terrain
Introduction Bots are a common presence on the internet, serving a range of functions from automating customer service to indexing page...
Private IP DNAT Support (Preview) and Scenarios with Azure Firewall
Introduction Azure Firewall is a cloud native security service to protect your workloads running in Azure. It is a stateful firewall as a serv...
Getting Started with Azure DDoS Protection REST API: A Step-by-Step Guide
REST API is a cornerstone in the management of resources on Azure, providing a streamlined and efficient approach for executing create, read, ...
Monitoring Azure DDoS Protection Mitigation Triggers
Monitoring Azure DDoS Protection Mitigation Triggers In today’s digital landscape, Distributed Denial of Service (DDoS) attacks pose a signifi...
Azure WAF’s Bot Manager 1.1 and JavaScript Challenge: Navigating the Bot Threat Terrain
Introduction Bots are a common presence on the internet, serving a range of functions from automating customer service to indexing page...
Utilizing Azure DDoS Protection Workbook for DDoS attack traffic Analysis
In today's digital age, the security of applications, servers, and networks is paramount. One of the most significant threats to this security...
Independent Configuration of Size Enforcement and Inspection Limits in Application Gateway WAF
Introduction In the constantly changing world of cybersecurity, both flexibility and effective security are essential for safeguarding ...
Private IP DNAT Support and Scenarios with Azure Firewall
Introduction Azure Firewall is a cloud native security service to protect your workloads running in Azure. It is a stateful firewall as a serv...
Monitoring traffic flows in Azure Firewall using Virtual Network Flow Logs
Azure Firewall is a managed service designed to protect your Azure Virtual Network resources, providing advanced threat protection and advance...