Azure Frontdoor WAF Blocked a Request

azure

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1190-exploit-public-facing-application

Set up the azure integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when an Azure Frontdoor Web Application Firewall (WAF) blocks a request from an IP address.

Strategy

This rule monitors Azure Activity logs for Frontdoor Web Application Firewall logs and detects when the @evt.name has a value of Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write and @properties.action has a value of Block.

Triage and response

  1. Inspect whether this request should have been blocked or not.
  2. Navigate to the IP dashboard and inspect other requests this IP address has made.