Azure WAF Sentinel solution does not query resource specific table

[tschleining]

The Azure Web Application Firewall solution for Sentinel currently queries the AzureDiagnostics table and not the "new" resource specific AGWFirewallLogs table

Ideally the solution would allow for both locations to be queried regardless of what diagnostic setting is set for the WAF resource.

[v-shukore]

Hi @tschleining, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!!

[v-shukore]

Hi @tschleining, could you please provide more information regarding this issue? Clarifying these details will help us resolve it more effectively. Thanks!!

[v-shukore]

Hi @tschleining, please provide more information regarding this issue. Thanks!!

[bedij03]

Hi @v-shukore - We are having the same issue.
Application Gateway resource specific tables for Diagnostic settings went GA in August, 2024.
https://azure.microsoft.com/en-us/updates?id=dedicated-log-analytics-tables-in-application-gateway

However, the sentinel connector for WAF is still quering on the AzureDiagnostics table as per the following json config.
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Web%20Application%20Firewall%20(WAF)/Data%20Connectors/template_WAF.JSON

Any timeline as to when the connector will be updated so that we can start using dedicated tables instead ?

Thanks!

[v-shukore]

Hi @bedij03,

Thanks for your response.

Currently, we don't have a plan to update the connector. We will share updates with the teams once we receive any update from them will update on GitHub accordingly. Meanwhile, you can follow the steps mentioned in the document for dedicated Application Gateway resource-specific tables.
https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics#storage-locations
https://learn.microsoft.com/en-us/azure/application-gateway/monitor-application-gateway-reference#resource-logs

[v-shukore]

Hi @tschleining @bedij03, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond to it in the next 2 days. If we don't receive a response by 29-12-2024 date, we will be closing this issue.
Thanks!